QR security demo · Demo B

Same link. Can you spot the fake?

A human can be taught to catch a lookalike domain when it's typed. Watch what happens when it's a QR.

https://your‑bаnk.example/login

That highlighted character is a Cyrillic “а” (U+0430), not a Latin “a” (U+0061). Different domain. Different owner. Your eye reads “bank.”

Same lookalike URL — now encoded. No character to inspect. No preview. Nothing to spot. You just scan and go.

Awareness / education material — lookalike domain is the speaker's own