What a QR code actually is
A QR code is a square pattern that stores a small amount of data, most often a web address. Your phone camera reads the pattern and offers to open the address. Nothing about the code is special or secret. It works like a printed link, except that you cannot read it with your eyes.
That last detail is the source of the risk. With a typed link, you can look at the address and judge it. With a QR code, you only see a pattern of squares. The code gives no hint about whether it leads to a menu, a payment page or a fake sign-in form.
Why scanning codes in public can be risky
Codes in public places are easy to tamper with. Someone can print a sticker with a different code and place it over the original on a poster, parking meter, charging station or restaurant table. Codes can also be sent in emails, letters or messages that appear to come from a company.
The typical goals of a harmful code are modest and familiar:
- Take you to a fake sign-in page that collects your username and password.
- Take you to a payment page that sends money to someone else.
- Ask you to install an app that is not what it claims to be.
- Collect personal details through a form that looks official.
None of this requires advanced technology. It relies on a person scanning without thinking, much like clicking on a link in a suspicious email. The same judgment you apply to phishing messages applies here.
Check the link before you open it
Most phone cameras show a preview of the address after scanning, usually as a small banner or text label. Do not tap it automatically. Read it first.
- Does the address match what you expect? A code on a restaurant menu should lead to something related to that restaurant. If the address is a long string of letters, a link shortener, or an unrelated name, pause.
- Look for lookalike spelling. Addresses can use extra letters, swapped characters or a familiar brand name placed in a longer address. Reading a web address carefully, and learning to spot lookalike web addresses, helps here. The important part of an address is usually the portion just before the first single slash.
- Be wary of shortened links. A short link hides the real destination. Some preview features expand them, which is useful.
- Check the page when it loads. Even if the address looked fine, think about what the page asks for. If a menu asks for your bank login, something is wrong.
Some scanner apps and phone cameras preview the link in full. If yours does not, a reputable scanner from the official app store may do so. Be careful here, though, since fake mobile apps pretending to be QR scanners exist. The built-in camera is usually enough.
Situations that call for extra caution
Parking and payment. Codes that ask you to pay for parking, charging or a service deserve a second look, especially if the sticker looks added on, crooked, or covers another code. If you can, use the official app or the payment machine instead. Following payment app mistakes helps you recognize unsafe payment behavior in general.
Unexpected mail and messages. A code in an unsolicited letter, email or text that urges quick action should be treated like any unexpected message. Text message scams and package delivery scams sometimes pair a code with urgent wording. It is better to visit the company’s website by typing the address yourself, or to use its official app.
Requests to sign in. If scanning leads to a screen asking for a password, stop. Go to the service directly through a bookmark or app instead.
Requests to install something. A code that prompts an app download is not the same as downloading from the official store. Install apps only through your phone’s official store, and review the developer and reviews first.
Wi-Fi codes. Some codes join a Wi-Fi network automatically. Joining a network a stranger set up can expose you to risks, and fake Wi-Fi hotspots can imitate a business’s network name. Ask staff for the correct network name when you can.
Codes that look tampered with. If a sticker is peeling, layered over another one, or looks out of place, avoid it. If you are in a business, you can mention it to staff.
If you already scanned and entered something
Do not panic. Take the steps that match what happened.
- If you only opened a page and entered nothing, close it. Nothing further is typically needed.
- If you typed a password, change it immediately on the real service, and anywhere else you used the same one. Password reuse makes one leak spread to several accounts.
- If you made a payment, contact your bank or card provider promptly to explain what happened. They can advise on options.
- If you installed an app, uninstall it and run any updates. Consider checking the permissions the app was granted.
- Watch for unusual activity on your accounts. Account takeover signs lists what to look for, and transaction alerts can help catch charges early.
Making your own QR codes safely
If you share a code, for example for a business or event, use a standard generator, test it on a different phone, and keep the printed version in a place where it cannot be easily covered. Say in words what the code does, so people know what to expect.
A short habit to adopt
Treat every code as a link that arrives from a stranger. Scan, read the preview, and ask whether the place and the address match. If anything feels off, skip it. Almost every legitimate service offers another way to reach the same page, and nothing is lost by taking a moment.