Are QR Codes Always Safe to Scan?

What to watch for in your QR code scanning habits.

Summary

A QR code hides a link you can't read with your eyes. Scanning one without seeing where it leads carries the same risk as clicking an unknown link.

Step by step

Before scanning, consider whether you trust the code's source.
Use your phone's preview feature to see the link before opening it.
Be cautious of an unexpected app-download prompt.
For a suspicious code, check its content with your own QR tool.

Why it matters

A QR code is just a harmless pattern. The risk is wherever it takes you. With a suspicious email link you can hover to check it, but a code on a wall or a table gives you no such hint. We also tend to scan codes when we are in a hurry: paying for parking, looking at a restaurant menu, responding to a delivery notice. Scammers aim for exactly that moment.

Common traps

A fake sticker placed over a real code. Parking meters, EV chargers and restaurant tables are common spots.
Codes on flyers or notes left at your door with urgent wording like "failed delivery" or "unpaid fine".
Codes leading to pages that imitate a bank or public service login and ask for your username and password.
Codes that promise Wi-Fi but connect you to a network you don't know.
Codes that try to download an app file directly.

Common mistakes

Tapping open without reading the address in the preview.
Missing small differences in the domain. Repeated letters, an added hyphen or an unusual ending are signs of a fake site.
Entering card details on a page opened from a QR code instead of opening the organization's official app or typing its address yourself.

An example

At a car park, there's a QR code on the payment machine saying "scan to pay quickly". You scan it and the preview shows an odd domain with no connection to the parking operator. Running a finger along the edge of the sticker, you notice another code underneath. The right move is to skip the code, pay at the machine itself or through the operator's official app, and tell the attendant. Had you already paid, you would need to call your bank right away and block the card.

If you print your own codes

If your business uses QR codes, you can protect customers too. Print the code somewhere hard to tamper with or laminate it, write the destination address in short readable form next to it, and check the labels regularly. A fake sticker is then much easier to spot.

When to get help

If you entered a password or card details on a fake page, contact your bank immediately and change the passwords on the affected accounts. If it happened on a work device, tell your IT team.