Are QR codes safe to scan?

QR codes went from novelty to everywhere: menus, parking meters, posters, parcels, bills, even TV ads. A QR code is just a picture of some text, usually a web link. The code itself can't hurt you. The question, as with any link, is where it takes you, and with a QR code you can't tell by looking.

How QR code scams work

Scammers like QR codes for three reasons. They hide the destination, they move people from a computer, where links are easier to inspect, to a phone, where they aren't, and they slip past email filters that scan text links but not images. Security researchers call this quishing, short for QR phishing.

The U.S. Federal Trade Commission has warned about the common versions:

• Stickers on parking meters and pay stations. A fake code over the real one leads to a convincing "pay for parking" page that collects card details.
• Texts and emails with a QR code and an urgent story: a missed delivery, a suspicious login, a document to sign, a security update.
• Letters and flyers that look official, with a code to "pay a fine" or "claim a refund".

Other variations include fake codes on posters offering discounts, codes that install apps from outside the official store, and codes that hold cryptocurrency payment addresses.

Where fake QR codes show up

How to check a QR code before you trust it

1. Look at the code itself. On public signs, check for a sticker placed on top of another code, peeling edges or a code that doesn't match the sign's design.
2. Read the preview. Most phone cameras show the address before opening it. Read the domain name (the part before the first single slash) and check it's the organization you expect.
3. Be extra careful with short links. If the preview shows bit.ly, qrco.de or similar, you can't see the real destination. Expand it first.
4. Use a checker. Take a photo or screenshot and upload it to the QR Code Link Checker. It reads the code on your device and shows every redirect and the final website.
5. Don't enter logins or payment details on a page you reached from a QR code unless you're certain it's the real site. When in doubt, go to the official app or website directly.

QR codes that aren't web links

A QR code can hold other things, and your phone will offer to act on them:

• Wi-Fi details to join a network. A fake network in a café or airport can watch your traffic.
• A phone number or text message, sometimes to premium-rate numbers.
• A crypto payment address. Crypto payments can't be reversed, and requests for crypto are a hallmark of scams.
• A two-factor (otpauth) setup code. Only scan these on a site you're signing up for yourself. A code from someone else could give them access to your account.

Our checker identifies these and explains what scanning would do.

If you already scanned a bad code

• If you only opened the page, close it. That alone rarely causes harm on an updated phone.
• If you entered card details, call your bank or card issuer straight away using the number on your card, and watch your statements.
• If you entered a password, change it on the real site, and anywhere else you reused it, and turn on two-step verification.
• If you installed an app, uninstall it, and run your phone's security check.
• Report it: in Canada to the Canadian Anti-Fraud Centre, in the U.S. at ReportFraud.ftc.gov. For a fake code on a parking meter, also tell the city or parking operator so they can remove it.

Bottom line: QR codes are safe when they lead where they claim to. Treat them like any other link from a stranger, and check before you pay or log in.