QR codes are just a convenient way to open a link, which means they're as safe, or as risky, as the link behind them. The codes themselves can't infect your phone, but scammers exploit the fact that you can't read a code with your eyes. Here's what's real, what's hype, and how to scan with confidence.
What a QR Code Can and Can't Do
A QR code is essentially a printed link. Scanning one can't directly install anything or take control of your phone. The risk lives entirely in where the link goes: a malicious or fake website, a payment redirect, or a credential-stealing page. The code is the messenger, not the threat.
How QR Scams Actually Work
The most common scam is a tampered code, where a sticker is placed over a legitimate one to redirect you to a fake site, often a counterfeit login or payment page. Because you can't see the destination before scanning, attackers rely on you trusting the placement.
Simple Habits to Scan Safely
Check the URL preview your phone shows before tapping, and be wary if it looks off or unrelated. Watch for stickers placed over existing codes in public places. Never enter passwords or payment details on a page reached by an unexpected code, and type known web addresses directly when in doubt.
Safety for Businesses Creating Codes
If you publish codes, protect your audience by using a clear, branded design so people can recognize a legitimate code, and by sharing sensitive material only through protected links. For confidential documents, a secure, password-protected code adds verification so the content isn't exposed to anyone who simply scans.
FAQ
Common questions are answered in the FAQ section below.