QRavn – QR code scam check

SECURITY PROFESSIONALS DON'T SCAN QR CODES WITH THE CAMERA APP

Every official guide on QR codes gives the same advice: read the web address before you open it. If you cannot see the address, do not proceed.

But the advice stops there. And even once you can finally see the address — do you know what you are looking for?

That is the job QRavn does. It reads the code and runs 49 checks on it before
anything opens. You are not just handed the link. You are handed the answer.


49 CHECKS, ACROSS THREE AREAS

26 checks on the address itself. Whether the real domain sits at the end
instead of the start, so that bankid.no.verify-login.example is not BankID at
all. Whether one letter has been swapped for one from another alphabet, so the name only looks right. Whether invisible characters are hidden inside the
address. Whether a username and password have been placed in front of the
domain. Whether the address is a raw number instead of a name.

16 checks on what the code actually contains. A QR code is not always a link. It can be a Wi-Fi network with no password, a pre-written SMS to a premium-rate number, a crypto wallet, or a key to your two-factor login.

7 checks on where the link forwards you. Shortened links that point at further
shortened links. Chains that hop from domain to domain. Redirects that drop
from encrypted to unencrypted along the way.

You do not need to know a single one of them. That is the entire point.


THIS IS ALREADY HAPPENING

In Kristiansand, Norway, more than 20 fake QR stickers were found on parking meters. They were stuck straight over the real ones, carrying the name of a parking company people trust.

In second-hand marketplaces, buyers are sent a QR code to "pay with", and the card is charged far more than the asking price. One person lost 90,000 kroner. Police and banks have warned about both.

A sticker costs a scammer almost nothing to print.


QRavn INVESTIGATES THE CODE INSTEAD OF OPENING IT

Point the camera at the code. Nothing opens. The 49 checks run immediately, on your phone, and you get a verdict with the reasoning beside it: what was found, where in the address it sits, and what it means.

Then you decide, holding what you should have had all along.


"AREN'T QR SCANNER APPS THE PROBLEM?"

Usually they are, and the warnings are fair. Most of them are advertising
businesses, and what you scan is the product.

QRavn holds no INTERNET permission at all. Not "we promise not to" — the
permission simply is not there, so it is Android itself that refuses to let the
app reach the network. It cannot upload what you scanned, because it cannot upload anything.

No account. No analytics. No ads. No scan history. It works in airplane mode.


WHAT IT SAYS, AND WHAT IT WILL NOT SAY

QRavn never tells you a link is safe. No app can promise that, however
confidently it is phrased. It tells you what it found, and what it could not
determine:

• the address imitates a name you know
• characters from another alphabet are mixed in, so letters look alike
• the link is shortened, so the destination is hidden
• the page asks for a login or for BankID
• the address is not encrypted

When it finds nothing, that is exactly what it says: "none of the 49 checks
found anything", not "safe". That difference is the whole point of the app.


BUILT FOR ANDROID

• Share a link to QRavn from any app
• Quick Settings tile: put the scanner in the panel you pull down
• Shortcut: long-press the icon and go straight to scanning
• Pick an image from your gallery instead of scanning
• Torch for codes in poor light
• Follows the system light and dark theme
• Norwegian Bokmål, Norwegian Nynorsk and English


PRIVACY

We collect no personal data. We cannot: the app has no way to send anything.
Full policy: https://qravn.isainative.dev/privacy


49 checks first. Then you decide.

QRavn is made in Norway, for people in Norway.

You don't open it alone.