Are QR Codes Safe? What to Know Before You Scan

QR codes got a reputation problem during the pandemic, when their use exploded for menus, check-ins, and payments, and scammers noticed. But the risk was never in the QR code technology itself; it's in treating an unfamiliar QR code with the same trust you'd give a link from someone you know.

What a QR code can't do

A QR code cannot install software, run code, or access anything on your device just by being scanned. It encodes data, almost always a short piece of text or a URL, and your phone's camera app simply decodes and displays it. Most modern phones show you the decoded URL before opening it, which is your actual checkpoint.

The real risk: where it points

The actual attack, sometimes called "quishing" (QR phishing), works by getting you to scan a QR code that leads to a fake login page, a fake payment page, or a malicious download, the same way a phishing email works, just delivered as an image instead of a link. A common real-world version: a scammer prints a sticker with a malicious QR code and pastes it directly over a legitimate one, on a parking meter, a restaurant table tent, or a public poster.

How to scan safely

• Check the URL preview your phone shows before tapping through. If it looks unfamiliar, misspelled, or unrelated to the context, don't proceed.
• Be more cautious with QR codes that appear as standalone stickers with no clear surrounding context, especially on public property.
• Don't enter passwords, payment details, or personal information on a page you reached via an unfamiliar QR code unless you already trust the source.
• Your phone's built-in camera app is enough. You generally don't need a third-party QR scanner app, and some request more device permissions than they need.

Making sure your own QR codes are trustworthy

If you're generating codes for customers, link directly to your own domain rather than a URL shortener they won't recognize, and always test the destination yourself before printing. A QR code that opens a page on your actual business domain reads as far more trustworthy than an unfamiliar shortened link.