Are QR Codes Safe? How “Quishing” Works and How to Scan Safely

QR codes are safe in the same way a link is safe: it depends on the destination. The pattern itself cannot hold a virus. It holds text, and the phone decides what to do with that text. That distinction is the core of the security picture.

What a QR code can and cannot do

• It cannot run code, install apps or access your files just by being scanned.
• It can point to a web address, which may be a phishing page or a download.
• It can carry a Wi-Fi join request, a contact card, or a pre-filled message, all of which your phone should ask you to confirm.

How QR phishing (“quishing”) works

Attackers rely on the fact that people cannot read a QR code. Typical patterns:

1. Sticker overlay. A fraudulent code is stuck over a real one, on a parking meter, restaurant table, poster or charging station. Several city and consumer agencies have warned about this with parking payments.
2. Unsolicited mail or email. A letter or image claiming to be from a bank, courier or employer asks you to scan to “verify” something. Putting the link in an image also helps it slip past email filters.
3. Look-alike payment pages. The code leads to a convincing fake that captures your login or card number.

How to scan safely

1. Read the preview. Current iPhone and Android camera apps show the web address before opening it. Read it. A genuine parking operator should not send you to an unfamiliar domain or a misspelled one.
2. Look at the physical code. If it appears to be a sticker on top of another surface, has uneven edges or a different finish from its surroundings, do not scan it.
3. Do not log in or pay from a scan you did not expect. Instead, type the company’s official address yourself or use its app.
4. Be careful with downloads. A code that leads to an app or file you did not seek is a red flag.
5. Treat Wi-Fi and contact prompts as you would any request. Join only networks you recognise.

Protecting your customers if you print codes

• Use your own domain, and show the address in text beside the code so people can compare.
• Make tampering obvious. Print codes directly on the surface, or use tamper-evident labels, and check public codes regularly.
• Prefer static codes that point to your site over third-party redirects, to avoid depending on a provider whose domain could be abused or lapse. See static vs dynamic QR codes.
• Tell customers what to expect: “This code opens yourcafe.com/menu”.

Codes you make yourself

A static code you generate cannot be silently redirected later, because the destination is baked into the pattern. This is a quiet security advantage of static codes. The codes made by our generator are created in your browser, so what you type is not sent to us, as explained in the privacy policy.

Bottom line

Treat a QR code like a shortened link from a stranger: check where it goes, trust surroundings and context, and never hand over credentials on a surprise scan. For how the code actually decodes, see how QR codes work.

Frequently asked questions

How do I preview where a QR code goes?

Current iPhone and Android camera apps show the web address before you open it. Read the domain carefully, and if it looks unfamiliar, misspelled or unrelated to where you found the code, do not open it.

Can scanning a code hack my phone?

Scanning alone is extremely unlikely to. Harm comes from opening a malicious page or installing something you were tricked into downloading. Keeping your phone updated and being cautious with prompts is the best defence.

What should a business do if it finds a fake sticker over its code?

Remove it, replace the code with one printed directly on the surface or in a tamper-evident label, warn customers, and report payment fraud to the relevant authorities or payment provider.

Our guides give general information based on QR specifications, calculations and worked examples. Results depend on your printer, materials and devices, so always test a real print. See our editorial policy.