Beyond ISOIEC 18004 Defining Security Controls for QR Code Generators and Scanning Libraries in Mobile Banking
Year: 2026
Type: dissertation
Abstract: The rapid integration of Quick Response (QR) codes into mobile banking for authentication, session linking, and payments has introduced significant security vulnerabilities. However, the foundational ISO/IEC 18004 standard focuses solely on data symbology and does not mandate security controls. Mobile banking users are increasingly exposed to phishing ("quishing"), malware delivery, and back-end injection-style attacks. This dissertation examines the security controls needed to protect users from malicious QR code payloads, using a structured secondary research methodology and thematic analysis of current academic and industry literature. This study critically evaluates the threat landscape, the vulnerabilities inherent in standard QR-scanning libraries, the efficacy of proposed mitigations, and reveals a critical disconnect between the high-assurance requirements of financial services and the generic, unvalidated design of default QR tools. To address this gap, this research proposes a consolidated security control framework for mobile banking QR Codes and an accompanying governance policy tailored for QR code generation and scanning in mobile banking, grounded in the OWASP MASVS. The framework is assessed against a simulated counterfeit payment QR code scenario to illustrate its potential practical applicability. Implementing these standardised controls is proposed as a necessary baseline to support the confidentiality, integrity, and availability of banking data. Future research should empirically validate this framework in live banking environments, including an assessment of its impact on user experience.
Source: Figshare
Author: Gareth Filer
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7218749355