Are QR codes safe? How to spot and avoid QR code scams

Scanning a QR code is generally safe in itself. A QR code only stores text, usually a web address, and your phone shows you what it contains before anything happens. The risk is where the code sends you. Scammers use fake codes, often stickers placed over real ones, to send people to look-alike websites that steal passwords or card details. This is called quishing. Check the address in the preview before you tap, and take extra care with any code that asks you to pay or log in.

What can a QR code do to your phone?

On its own, very little: a QR code is data, not software. When you scan one, the phone decodes the text and offers an action based on it. If you want to know how the pattern stores that text, see what is a QR code?

A QR code can:

• Offer to open a web address in your browser.
• Offer to join a WiFi network.
• Offer to save a contact or a calendar event.
• Open a pre-filled text message, email or phone number, ready for you to send or call.
• Show a piece of plain text.

A QR code cannot:

• Install an app by itself.
• Run a program on your phone.
• Take money from your account by itself.
• Send a message or place a call without you tapping send or call.

The danger starts after you tap. The page you land on may ask you to log in, pay, download a file or app, or allow notifications. Treat it as you would a link in an unexpected email.

Keep your phone and browser updated, because a malicious page can occasionally take advantage of flaws in old software. Be careful with WiFi codes in public places too, since a code could connect you to a network run by someone you do not know.

What is quishing?

Quishing is phishing with a QR code. Instead of a suspicious written link, the victim gets a code that leads to a fake page made to look like a real login, delivery or payment page. It works for a few reasons. People cannot read a QR code by eye. Phone screens show less of a web address than a computer does. And a link hidden inside an image can be harder for some email filters to inspect than a written one.

Common forms include:

• Emails and letters claiming there is a problem with your account, a parcel or a payment, and asking you to scan a code to sort it out.
• Fake codes on parking meters and pay stations that lead to copycat payment pages.
• Stickers over genuine codes on menus, posters and flyers.
• Messages offering prizes, refunds or discounts if you scan and enter your details.

The common thread is urgency. A real organisation rarely needs you to act within minutes through a code you did not expect.

Can scammers put stickers over real QR codes?

Yes, and it is the simplest trick, needing nothing more than a printer and a sheet of stickers. A scammer prints a code that points to their own site and sticks it over the real one on a sign, a menu or a machine. To anyone passing by, it looks like part of the design.

• Look for raised or peeling edges, a code that sits slightly crooked, or a finish that differs from the rest of the sign.
• Watch for a code that looks newer or brighter than the material around it.
• Be suspicious of two codes where you would expect one.
• After scanning, check that the address matches the organisation named on the sign.

Are QR codes on parking meters safe?

Not always, and payments are where fake codes do the most harm. Councils, police and consumer bodies in several countries, including the US Federal Trade Commission, have warned about fake codes on parking meters and pay stations. The victim pays on a copycat site, the card details are stolen, and the parking is not actually paid, so a fine can follow.

1. Use the parking operator's official app from your phone's app store, or type its website address yourself.
2. If the sign prints a web address, compare it with the one in the scan preview.
3. Be wary of a page that asks for card details straight away or looks generic.
4. If in doubt, pay at the machine, by phone, or with another method shown on the sign.
5. If you think you have paid a fake site, contact your bank straight away.

How to check a QR code before you open it

1. Read the preview. Recent iPhone and Android cameras show the address before opening it. Our guide on how to scan a QR code shows where to look.
2. Check the domain name. This is the part just before the first single slash. Look for misspellings, extra words, swapped letters or a name that has nothing to do with the organisation.
3. Be careful with unfamiliar short links. A short link hides the final destination. Many businesses use them honestly, but they deserve more care when the code is in a public place.
4. Look at what the page asks for. A menu should not need a password. A poster should not need your card details.
5. Install apps only from the official store. If a page tells you to download an app, search for it in the store yourself.
6. When unsure, do not scan. Type the organisation's address into your browser instead.

How businesses can protect their QR codes

If customers scan your codes, you can make fake ones much easier to spot and keep control of where they lead.

Make fake codes easy to spot

• Make tampering obvious. Print codes directly onto signs, menus and packaging, not on loose stickers. Put codes in public places behind glass or acrylic, or use tamper-evident labels that show when they have been peeled.
• Use a short, branded domain. When the scan preview shows your own name, customers can check it. Print the same address as text under the code.
• Check printed codes regularly. Ask staff to scan each code on a schedule and look for stickers that should not be there. With dynamic codes on a paid plan, a sudden drop in scans at one location can be a sign that a code has been covered.
• Tell customers what to expect. A line such as "Our codes only lead to our own website" helps people spot fakes. Never ask for passwords through a code.

Protect the codes you control

• Protect the account behind dynamic codes. Whoever controls that login controls where every printed code points. Use a strong, unique password.
• Choose a generator you can trust. A static code shows exactly what it contains and depends on no outside service. The EndureQR free generator creates codes in your browser, and nothing you type is sent to a server.

If you are deciding which kind of code to use, our guide to static vs dynamic QR codes covers the trade-offs.