Scanning a QR code on its own is almost always safe. A QR code is just text printed as a pattern, and your camera reading it doesn't run anything. The danger is the next tap: the link it opens, the payment page you land on, the Wi-Fi network your phone joins. That's why scammers like QR codes. You can't read the destination with your eyes, so a sticker on a parking meter or a code in an email skips the "does this link look right?" check people have learned to do. Here's what can actually go wrong and how to check a code before you trust it.
Not by itself in any realistic case today. The camera app decodes the pattern into text and shows you a preview. Nothing happens until you tap it. The rare exceptions have been bugs in how phones displayed that preview: in 2018, a researcher showed the iOS 11 camera could show one domain in its notification and open a different one, which Apple fixed in iOS 11.3. Keeping your phone updated covers that kind of problem.
What a code can do is send you somewhere harmful or set something up on your phone with one tap. That's a social-engineering problem, not a technical one, and it's where all the real losses come from.
A QR code can hold a web address, but it can also hold instructions your phone knows how to act on. Your camera shows a different prompt for each type:
| What the code contains | Starts with | What tapping does | How it's abused |
|---|---|---|---|
| Web link | https:// | Opens the page | Fake payment, login or delivery pages; malware downloads |
| Wi-Fi login | WIFI: | Joins the network | Joining an attacker's hotspot that can watch unencrypted traffic |
| Text message | SMSTO: or sms: | Opens a pre-written text | Texting a premium-rate number or "confirming" a scam |
| Phone call | tel: | Offers to dial | Calling a fake support line |
mailto: | Opens a drafted email | Sending your address to a spammer | |
| Contact card | BEGIN:VCARD | Offers to save a contact | Saving a fake "bank" number that later looks trusted |
| Crypto payment | bitcoin: and similar | Opens a wallet with the address filled in | Swapping the address so payment goes to the scammer |
| 2FA setup | otpauth:// | Adds an account to your authenticator app | Mostly harmless, but a sign someone's playing setup games |
The pattern is the same in every row: the code fills in something you'd normally type, and you confirm it without really reading it.
Security people call it "quishing," QR phishing. The FBI warned about tampered QR codes in a January 2022 public service announcement, and the FTC issued a consumer alert in December 2023. The common setups:
Almost every one of these adds urgency: a fine, a closing account, a delivery about to be returned. That's the tell. A real parking meter doesn't need you to hurry.
Look at the preview, and specifically at the domain, the part right before the first single slash. That's the site you'll actually land on. Scammers rely on long addresses where the real brand name appears somewhere other than the domain. Here's how a browser reads some common tricks (we ran each through the same URL parser our URL Parser uses):
| What the code contains | Site you'd actually visit | The trick |
|---|---|---|
https://www.paypal.com/signin | www.paypal.com | None, this is the real one |
https://paypal.com.account-check.co/login | paypal.com.account-check.co | Brand used as a subdomain; the real site is account-check.co |
https://[email protected]/verify | secure-login.top | Everything before @ is treated as a username and ignored |
https://pаypal.com/ (Cyrillic "а") | xn--pypal-4ve.com | Lookalike letter; the browser converts it to punycode |
https://bit.ly/3xYz12 | bit.ly, then a redirect | Shortener hides the final destination |
https://parkmobile.pay-meter.net/ | parkmobile.pay-meter.net | Real app name, wrong domain |
If you'd rather not open anything on your phone, our QR code scanner decodes a code from your camera or from a screenshot and shows you the full text first. It only offers an "Open link" button for web addresses, and the decoding happens in your browser, so the image isn't uploaded. It doesn't check a link's reputation, though. Reading the domain is still your job.
Made a code yourself and want people to trust it? Use a plain, readable destination on your own domain, avoid shorteners, and print the address under the code. Our QR code generator encodes the link directly, with no redirect service in between, so the code keeps working even if a tracking service shuts down. See do QR codes expire? for why that matters.
If you only opened the page, close it. That alone is rarely a problem. If you typed a password, change it right away on the real site, and anywhere else you've reused it, then turn on two-factor login. If you entered card details, call your bank and ask for the card to be cancelled and reissued. If you joined a Wi-Fi network, forget it in your settings. Then report it: to the FTC at ReportFraud.ftc.gov in the US, and to whoever owns the meter, shop or brand being impersonated, so they can take the sticker down.
Practically, no. Scanning only decodes text and shows a preview. The risk comes from opening the link, entering details or accepting what the code sets up, such as joining a Wi-Fi network. Keep your phone updated to cover rare preview bugs.
Check whether it's a sticker over another code, then read the domain in the scan preview before opening it. Be suspicious of shortened links, brand names used as subdomains, and any page that rushes you to pay or log in.
Usually, but those are the places scammers put fake stickers. For payments, use the operator's official app or type its web address yourself instead of following the code.
Quishing is phishing with a QR code. Instead of a clickable link, the scam email, letter or sticker shows a code that leads to a fake login or payment page. Because the link is inside an image, it can get past email link scanners.
Yes. Your phone's camera shows the address in a preview before you tap. A QR scanner that decodes to text, like ToolAspect's QR code scanner, shows the full contents and won't open anything unless you choose to.