9.1 Recommendations
9.1.1 QR Codes have been the subject of abuse - particularly where there is a financial transaction involved: for example, on car park ticketing systems.
9.1.2 We therefore recommend that secure protocols, such as HTTPS, are always used.
9.1.3 The use of official, short, recognisable domains e.g. https://bus.gov.uk/stop/1234 and the avoidance of obscure third-party links helps users to identify fakes or compromised QR Codes.
9.1.4 It is good practice to monitor the use of QR Codes to identify any unusual traffic patterns which may suggest issues at one or more locations.
9.1.5 A process for disabling QR Codes quickly if misuse is detected should be in place.