TrustLens: A Survey of Multi-Layer URL Threat Detection for Secure QR Code Scanning

QR-code phishing succeeds because users cannot tell where a QR code points and because many scanners automatically follow links without checking. Published work presents blacklist, lexical ML, content based, QR-image and cryptographic defences that are combined in QR-specific scanners to adopt a couple of them, but each manages one or two kinds of evidence and a few justify their verdicts. This survey categorized the area according to the level of analysis, detection technique and the way the risk is communicated, and compared twenty studies from 2022 to 2026. We presented TrustLens, a layered scanner that combines reputation, lexical ML and redirect-analysis signals into a three-class verdict with explanations before any link is opened. Realizing the design requires careful threshold calibration, robust handling of external services, representative datasets and, most of all, evaluation with real users.

1. Mossano, M., Veit, M.F., Länge, T., Berens, B.M., Sharevski, F., Volkamer, M.: Development, Evaluation, and Implementation of SEQR – a Usable Secure QR Code Scanner. In: Proc. ACM CHI Conference on Human Factors in Computing Systems (CHI '26). ACM (2026) 2.   Njuguna, D., Ndia, J.G.: Quick Response Code Security Attacks and Countermeasures: A Systematic Literature Review. J. Cyber Secur. (2025). https://doi.org/10.32604/jcs.2025.059398 3.   Vidas, T., Owusu, E., Wang, S., Zeng, C., Cranor, L.F., Christin, N.: QRishing: The Susceptibility of Smartphone Users to QR Code Phishing Attacks. In: Financial Cryptography and Data Security Workshops, LNCS 7862, pp. 52–69. Springer (2013) 4. Kharraz, A., Kirda, E., Robertson, W., Balzarotti, D., Francillon, A.: Optical Delusions: A Study of Malicious QR Codes in the Wild. In: Proc. 44th Annual IEEE/IFIP Int. Conf. on Dependable Systems and Networks (DSN). IEEE (2014) 5.  Rafsanjani, A.S., Kamaruddin, N.B., Rusli, H.M., Dabbagh, M.: QsecR: Secure QR Code Scanner According to a Novel Malicious URL Detection Framework. IEEE Access 11, 92523–92539 (2023) 6.  Sheng, S., Wardman, B., Warner, G., Cranor, L.F., Hong, J., Zhang, C.: An Empirical Analysis of Phishing Blacklists. In: Proc. 6th Conf. on Email and Anti-Spam (CEAS) (2009) 7.  Shevchuk, R., Ihas, P.: QR Code Scanner with Anti-Qrishing Real-Time Technique. In: Proc. 15th Int. Conf. on Advanced Computer Information Technologies (ACIT), pp. 559–564. IEEE (2025) 8.  Alsulami, A.A., Abu Al-Haija, Q., Alturki, B., Yafoz, A., Alqahtani, A., Alsini, R., Binyamin, S.S.: Efficient Malicious QR Code Detection System Using an Advanced Deep Learning Approach. Comput. Model. Eng. Sci. (CMES), 1117–1140 (2025) 9.  Trad, F., Chehab, A.: Detecting Quishing Attacks with Machine Learning Techniques Through QR Code Analysis. arXiv:2505.03451 (2025) 10. Akram, M.W., Sood, K., Hassan, M.U.: QRïS: A Preemptive Novel Method for Quishing Detection Through Structural Features of QR. arXiv:2510.17175 (2025)