Are QR Codes Safe to Scan?

What QR codes can and cannot do

A QR code is a data container. It holds information — most commonly a URL, but also contact data, Wi-Fi credentials, plain text, or other formatted data. The code itself is passive: it holds data, and the scanning device processes that data.

What a QR code cannot do: it should not install software or access your phone's data simply by being scanned, and a well-designed camera app asks before acting. The scan event reads the data in the code and passes it to the device's software for processing. Nothing happens until the device actively responds to what the code contains.

What a QR code can do: it can present a URL that your browser will offer to open. If you open a malicious URL, the risks are the same as clicking a link in an email — the risk is in the destination, not the code. A QR code can also encode Wi-Fi credentials that your phone will offer to connect to, or contact information it will offer to save.

The real risks: quishing and malicious redirects

The primary security concern with QR codes is quishing — phishing attacks delivered via QR code rather than email links. An attacker creates a QR code linking to a fake login page designed to capture usernames and passwords. The QR code is placed in a context where the victim expects it — on a physical flyer, on a parking meter, on a sign in a public location.

The attack exploits the fact that QR codes conceal their destination. A suspicious URL in an email is often visible and recognisable. A QR code reveals nothing about its destination until it is scanned.

Malicious redirects are a related risk: a code that initially links to a legitimate page may later have its destination changed (if it is a dynamic QR code) to point to something malicious. This risk applies specifically to dynamic QR codes managed by third-party services. Static QR codes cannot be changed after generation.

Physical tampering: stickers over legitimate codes

A documented real-world attack involves placing malicious QR code stickers over legitimate ones. A restaurant table's legitimate menu QR code is covered with a sticker containing a code linking to a phishing page. A parking payment terminal's QR code is replaced with one that links to a fake payment site.

This attack is effective because people expect to find QR codes in these locations and scan without scrutiny. Signs of tampering: the code looks like a sticker on top of another surface, the code's quiet zone (white border) is not perfectly aligned with the card or material, the code looks slightly off-centre or slightly different from other codes in the same set.

If anything about a QR code on a physical location looks like it might have been altered, do not scan it. Use the location's known website directly, or ask staff to confirm the code is legitimate.

How to scan QR codes safely

Preview the URL before opening it: on iPhone, the camera app shows the URL the code contains before you tap to open it. On most Android phones, the camera app shows a similar link preview. Read this URL before proceeding.

Look for HTTPS: any URL a QR code links to should begin with https://. The absence of HTTPS does not mean the site is definitely malicious, but it means the connection is unencrypted and the site is operating below current security standards.

Look for familiar domains: a URL like universalqrgenerator.com/menu is from a domain you can verify. A URL like universalqrgenerator.secure-login-portal.com is suspicious — the actual domain is secure-login-portal.com, not universalqrgenerator.com.

Be more careful in high-risk contexts: parking payment terminals, bank ATMs, and financial service locations are higher-risk targets for QR code fraud than restaurant menus. Apply more scrutiny to codes in financial contexts.

Creating trustworthy QR codes for others

If you are creating QR codes for others to scan, you have a responsibility to make them trustworthy. Several practices help:

Always link to HTTPS URLs. HTTP destinations are a trust signal problem.

Use your own domain for the destination. A QR code linking to yourbrand.com is more trustworthy than one linking to a generic URL shortener or a third-party platform.

Add a clear call to action near the code — 'Scan for our menu' or 'Scan to connect to guest Wi-Fi' — that tells people what to expect before they scan. This context both increases scan rates and helps people verify that what they see after scanning matches what was promised.

Use static QR codes that cannot be changed. If your code cannot be altered by a third party (as is the case with static codes), one category of misuse is eliminated entirely.

QR codes and privacy: what data is collected

Scanning a QR code can involve data collection, but which data depends entirely on the destination.

The QR code itself collects nothing — it is a passive pattern with no tracking capability. Any tracking happens at the website or service the code links to.

A URL with UTM tracking parameters (common in marketing) allows the website operator to know that you arrived via a specific QR code. This is the same data collected from any tracked link.

Dynamic QR codes through third-party services may collect data about when and where codes are scanned. The third-party service logs scan events, potentially including device type, approximate location, and time. If privacy is a concern, prefer static QR codes linking to URLs you control.