Making QR Codes Safe by Design: A Trust-On-First-Scan Model (TOFS)
Source: Dev.to
By Colten Jacob, January 2026
QR codes have quietly become one of the most powerful interfaces in modern computing. A single square can initiate a payment, open a menu, log you into an account, or redirect you to a website. Billions of people now scan QR codes every day—often in public places, often without thinking.
That convenience comes with a serious flaw: QR codes were never designed for hostile environments. They were invented for factories and inventory systems, not for public walls, cafés, and payment terminals where anyone can replace a sticker in seconds. The result is an explosion of QR‑based phishing, payment redirection, and fraud.
This article proposes a simple but powerful fix: Trust‑On‑First‑Scan (TOFS) — a model that brings persistent trust and tamper detection to QR scanning, without breaking usability.
The core problem with QR codes
-
A QR code is not a label.
It is a command. -
When you scan it, your phone executes whatever it contains:
- open a URL
- start a payment
- launch an app
- download a file
Most scanners do this immediately, giving the user no way to tell whether:
- the QR code was changed,
- the destination was swapped, or
- the sticker was replaced.
This enables what security engineers call a substitution attack: the attacker doesn’t need to hack the website; they just replace the QR code.
Common targets include:
- parking meters
- restaurant menus
- UPI posters
- event tickets
- building entrances
A perfectly valid‑looking QR is enough to redirect money, steal credentials, or deliver malware.
Why existing defenses don’t solve this
We already have:
- HTTPS
- Google Safe Browsing
- Antivirus
- App sandboxing
But QR attacks slip between the cracks because most QR fraud uses:
- real browsers
- real payment apps
- real web pages
…just the wrong destination. Nothing is technically “malware.” It’s a trust problem, not a code problem.
Borrowing a proven security idea
In computer security there is a well‑known pattern called Trust‑On‑First‑Use (TOFU):
- SSH uses it.
- Bluetooth pairing uses it.
- Some certificate systems use it.
The idea is simple: the first time you connect to something, you verify it; after that, changes are treated as suspicious.
QR codes lack an equivalent concept—that’s what Trust‑On‑First‑Scan (TOFS) provides.
What is Trust‑On‑First‑Scan?
TOFS is a lightweight trust framework for QR scanning. It has four parts:
- First‑scan confirmation
- Destination fingerprinting
- Local trust storage
- Expiry and mismatch detection
Together, they make QR codes tamper‑evident.
How TOFS works
1. First scan = explicit trust
When a QR is scanned for the first time, the phone does not immediately open it. Instead it shows:
- the full domain
- the app that will open (browser, UPI, etc.)
- the protocol (https, upi, etc.)
The user taps “Trust & Open.” This is the only time the user has to think.
2. A fingerprint is created
The scanner creates a cryptographic fingerprint from:
- the QR content
- the final resolved destination (after redirects)
- the target application
This fingerprint uniquely represents where this QR actually goes.
3. The fingerprint is stored locally
The phone stores:
- the fingerprint
- the domain
- a timestamp
- an expiry date
This becomes the trusted identity of that QR code.
4. Future scans are automatic
-
If the fingerprint matches: the QR opens instantly, no prompts, zero friction.
-
If anything changes: the phone warns:
“This QR code has changed. The destination is different from what you previously trusted.”
This stops sticker swaps, redirected payment QRs, hijacked menu links, etc.
Why expiry matters
Public QR codes change over time:
- Cafés change menus.
- Parking operators change vendors.
- Websites get sold.
- Domains get hijacked.
TOFS includes expiry policies, e.g.:
- café QR: 30 days
- parking QR: 7 days
- bank poster: 180 days
When expired, the QR simply requires re‑confirmation, preventing stale trust from becoming a vulnerability.
Why this belongs in the OS
A standalone QR‑scanner app won’t fix this. People scan using:
- Camera app
- Google Lens
- Payment apps
Therefore TOFS must live in the system QR frameworks (Android, iOS, UPI QR handlers, etc.), just like HTTPS warnings or download prompts. It is a platform‑level safety layer, not a replacement for existing security.
What TOFS does not replace
- Safe Browsing
- Antivirus
- UPI verification
- TLS
It adds what those systems lack: memory of what a QR was supposed to be. Firewalls stop bad sites; TOFS stops wrong sites.
Why this is practical
TOFS requires:
- No new QR format
- No new hardware
- No network calls
- No cloud storage
Everything is local: a hash, a timestamp, a warning screen. That makes it deployable at scale.
Final thought
QR codes won the usability war. They are everywhere because they are effortless. But effortlessness without memory is dangerous. Trust‑On‑First‑Scan gives QR codes something they’ve always lacked: a sense of identity over time. That single change turns QR codes from blind commands into verifiable tools—and that’s how you make a global interface safe.
Related post
Trust‑On‑First‑Scan (TOFS): a security model for QR codes – by Colten Jacob (January 2026)