Are QR codes safe to scan? What a code can and cannot do

Warnings about QR code scams can make it sound as if pointing your phone camera at a black-and-white square on a parking meter will silently infect your iPhone with spyware. That is not how QR codes work.

A QR code (ISO/IEC 18004) is not a program or an executable file; it is a passive string of text characters printed as squares. Understanding the exact line between decoding the text (which your camera does safely on your phone) and acting on the text (tapping the banner to open a link or enter a credit card) makes it easy to spot a scam in two seconds.

What happens when your camera looks at a QR code

How real-⁠world QR code scams actually work

According to the FBI Internet Crime Complaint Center (IC3) public service announcement on QR code tampering, attackers use QR codes for three main reasons:

1. Physical sticker overlays on payment signs: in car parks, EV charging stations and bike-⁠share docks, scammers print a sticker with their own QR code and paste it directly over the legitimate printed code on the sign. A driver in a hurry scans the sticker, sees a convincing clone of the parking checkout page, and types their credit card number into a form that does not support Apple Pay or Google Pay.
2. “Quishing” emails and PDFs: corporate email filters scan the text of incoming emails for known phishing URLs. By hiding the phishing URL inside a QR code image inside a fake “Re-authenticate your Microsoft 365 / HR account” PDF, attackers bypass basic link scanners AND trick employees into scanning the code with their personal phone (which sits outside the company’s laptop security filter).
3. Opaque URL shorteners: when every legitimate restaurant and event flyer uses third-⁠party dynamic QR short links (qrco.de/..., bit.ly/...), people get conditioned to tap unfamiliar 6-⁠letter domains without knowing where the redirect will land.

Four checks to run before you tap any QR code

Use your phone’s built-⁠in iOS Camera or Android Camera (never a third-⁠party “QR Scanner” app with ads) and run these four two-⁠second checks:

1. Run your finger over public parking meter, EV charger or table-⁠payment QR codes to check that a raised paper or vinyl sticker has not been pasted on top of the original sign.
2. Point your built-⁠in Camera app at the code and read the domain name shown inside the preview pill before tapping it; if the sign is for City Parking and the preview pill says a random shortener or unrelated domain, do not tap it.
3. If you do open a QR link that redirects through a shortener, check the final address bar in Safari or Chrome before typing any login, email address or card number.
4. Never scan a QR code inside an unexpected email, text message or parcel slip that claims your account, bank card or two-⁠factor authenticator needs urgent re-verification.

How to make QR codes that your own customers can trust

If you print QR codes for your own business cards, menus or Wi-⁠Fi signs, design them so security-conscious visitors never have to guess where your code leads:

• Use a static QR code with your real domain: when you generate a code in our free static QR code generator, the squares encode https://yourdomain.com/menu directly rather than a third-⁠party tracking redirect. When a customer points their iPhone at your card, the yellow camera pill displays your actual company domain immediately.
• Print the readable URL underneath the square: adding a small caption like yourdomain.com/menu right below the QR code reassures visitors and gives anyone who prefers typing the address a direct path.
• Avoid putting QR codes inside account-security emails: train your clients and team to expect account actions inside your official app or dashboard rather than via emailed QR codes.