QR code phishing protection
Last updated: October 13, 2026
A QR code hides its destination. That is why attackers use it for phishing, often called quishing. This page describes the checks reRoute runs on rrte.link short links today, and how you can check or report a link. We describe only what is in place now.
Why it matters
Microsoft reported that QR code phishing attacks rose from 7.6 million in January 2026 to 18.7 million in March 2026, a 146% increase over the quarter.
A person cannot read where a printed square leads. The checks below run when a link is saved and after it is live, so the person who scans does not have to judge the destination alone.
Source: Microsoft Threat Intelligence, Email threat landscape: Q1 2026 trends and insights (April 30, 2026).
What we check when a link is saved
When a workspace creates or changes a single link, we look up the destination URLs on Google Web Risk. If Google lists a destination as malware, social engineering (phishing), or unwanted software, we reject the save.
On the Free plan, we go further each time a link is created or its destination changes. We follow the whole redirect chain, look up every hop on Google Web Risk, and check how old the destination domain is.
We also reject destinations whose host name resolves to a private network address.
What we check after a link is live
A scheduled threat scan runs every 10 minutes. It checks links that were never checked first. It re-checks other links when the last check is more than 24 hours old. For each link it follows the redirect chain and looks up every hop on Google Web Risk.
The chain follower follows HTTP redirects. It also follows a page that forwards the browser with a meta-refresh tag or a literal JavaScript location assignment. This is best effort. A redirect built from obfuscated or computed JavaScript is not detected, and that page is judged on its own URL.
Links written in a batch on a paid plan skip the lookup at save time. The scan picks them up.
What a person sees when they scan
The redirect route shows a warning or a stop page in these cases.
- Listed destination. If Google Web Risk lists the destination, or a page it redirects to, the visitor sees a stop page. The page has no Continue button, and the visitor is not forwarded.
- Link being checked. On the Free plan, if the save-time check cannot finish, the link waits for the scan for up to 15 minutes. A visitor sees a "This link is being checked" page. If the wait ends with no completed check, the visitor sees where the link goes and chooses whether to continue.
- New domain. On the Free plan, if the destination domain was registered in the last 30 days, the visitor sees a warning that names the host and chooses whether to continue. Domain age comes from public RDAP records. If the age is unknown, there is no warning.
- Removed destination. If staff remove a destination after an abuse review, or suspend the whole workspace, the link shows a page that says the destination was removed. It has no Continue button.
A limit on bait and switch
A common trick is to create a harmless link, print it, then point it at a phishing page. On the Free plan, a workspace can change link destinations 10 times in 24 hours. Every change is checked again as described above.
Controls against abuse of the service
Platform admins can suspend a workspace. While a workspace is suspended, its links show the removed page and it cannot create or change links.
Sign-up rejects disposable email addresses, is rate limited per IP address, and uses a Cloudflare Turnstile challenge.
Abuse reports go to loading..., which is also listed in our security.txt file. A person reviews each report. A report does not disable a link by itself. The takedown policy states the limits, including that we make no response-time promise.
What these checks do not do
No check catches every malicious page. Google Web Risk lists known threats. A page that is new and not yet listed can pass. This is why we also warn about new domains on the Free plan.
Web Risk lookups fail open. If Google does not answer, a save is allowed and the scan tries again later.
On paid plans, the save-time check looks up the URLs you typed. The scan follows the redirect chain after the link is saved.
How to check a ReRoute link before you scan
You can look at a short link without visiting its destination. Add ?preview=1 to the end of the link, or add a + to the end of the short code. For example, rrte.link/abc123+ opens the link check page instead of the destination.
The link check page shows the destination host and the full URL. A preview does not count as a scan. If the destination varies by time, location, or device, the page says so and shows the default URL. If the link is password protected, still being checked, or removed, the page says that and does not show the URL.
If the destination looks wrong, do not continue. Report the link.
Report a link
The link check page has a report form. Choose a reason: phishing or impersonation, malware or unwanted software, scam or fraud, or something else. You do not need an account.
You can also email loading... with the short link and a short description.