QR Code Scams: How to Scan Safely With Your Phone
A QR code is just a picture that holds a web address, so scanning one is like tapping a link you cannot read. That makes QR codes a convenient hiding place for scammers: they can paste a sticker over a real code, send one in a text, or print one on a fake notice. The phone camera makes scanning effortless, which is exactly why a quick pause before opening the result is worth it.
- A QR code hides a link; a fake one leads to a spoofed page or tries to get you to install an app.
- Check the web address your phone shows before you open it, and be wary of codes in unexpected texts or emails.
- Stickers placed over a printed code, for example on parking signs, are a known trick.
- Do not install an app or enter a password because a QR code told you to; go to the official store or site yourself.
How QR scams work
Reports on a US Federal Trade Commission consumer alert describe scammers replacing real QR codes with their own on things like parking meters, and sending codes by text or email with a story about a delivery or an account problem.[1] The code leads to a fake page designed to capture a login or payment, or tries to get you to install something. The code itself does not "infect" the phone; the harm comes from what you do after the scan.
Where fake codes turn up
- Stickers over parking, ticket or payment-point codes
- Unexpected texts and emails about parcels, fines or locked accounts
- Flyers, posters and "scan to win" prizes
- Fake notices on doors or windows
- Codes on messages from people you do not know
The same urgency tricks as in text-message scams apply.
A short checklist before you open the result
- Look at the address. Most camera apps show the link before opening it. Check the domain, not just the start of it, and be suspicious of odd spelling or shortened links.
- Look at the code. If it is on a sticker, see whether it covers another code or peels up.
- Ask who it came from. A code you did not expect is not to be trusted.
- Do not enter logins or card details on a page you reached from a code unless you are sure of it. Go to the official app or site yourself instead.
- Never install an app because a code told you to. Use Google Play and check the listing; see how to spot a clone.
If you already scanned and entered details
- Change the password for the account you used, and for any other that shares it.
- Contact the real company or your bank through an official channel.
- If an app was installed, remove it and run a Play Protect scan.[2]
- Watch your statements for activity you do not recognise.
Teaching the family
Children enjoy scanning codes, from games to school notices, so a calm habit helps: look at the link before you tap it, and ask if it is unexpected. For older relatives, point out that a QR code in a text from a stranger is the same as a link from a stranger.
A note for shops and businesses
If you display a QR code, such as a menu or payment code, check it regularly for stickers placed over it and consider printing it inside a frame or on a surface that is harder to tamper with. Put the web address in words next to the code, so customers can check it. If customers are told to scan a code to pay, tell them the exact name they should see before they confirm.
The same advice applies to a school or club that sends notices with QR codes: say clearly where the code leads and avoid asking for logins.
Frequently asked questions
Is it safe to scan a QR code?
Scanning is generally safe in itself; the risk is the page you are taken to or what you do next. Check the address and avoid entering sensitive details.
Can a QR code hack my phone?
A code only holds data such as a link. Harm usually comes from opening a malicious page or installing an app, not from the scan alone.
What is quishing?
Quishing is phishing that uses QR codes. The code replaces a clickable link, which can make it harder for filters and for you to spot the destination.
How can I check where a QR code goes?
Use a camera or scanner that shows the address before opening it, and look at the domain carefully. If it looks wrong, do not open it.
Should I download a QR scanner app?
Usually not. Most phone cameras can scan codes, and extra scanner apps can add ads or permissions. If you use one, check it first.
- FTC warns of QR codes used by scammers — PCWorld — secondary reporting on the FTC consumer alert; check the FTC site for current guidance.
- Google Play Protect — Google Play Help — scanning apps on your device.