What a QR code actually is
A QR code is a pattern of squares that encodes data. It can encode a URL, plain text, Wi-Fi credentials, a calendar event, or contact details. A QR code is not inherently malicious; it is a container for encoded data. The practical risk depends on what the data represents, how the scanning app handles it, and what happens after the scan. A URL code should be evaluated like another link, while a code for Wi-Fi, contact, login, or payment data can trigger a different proposed action.
Separating the steps involved
A single QR code interaction can involve several genuinely distinct steps, and treating them as one action obscures where the actual risk sits:
- Scanning — your camera or scanner reads the pattern and decodes it into data. In a preview-based camera flow this does not open the destination; scanner-app behavior can vary, so disable automatic opening if an app offers that option.
- Previewing the destination — some scanning tools show the decoded content, such as a URL, before doing anything with it.
- Opening the destination — you choose to follow the link, which loads a page the same way clicking any other link would.
- Downloading — the page may offer or initiate a file download.
- Installing — you choose to install something you downloaded, or the code encodes a direct app or configuration-profile install link.
- Granting a permission — a page or app requests access to something on your device.
- Entering information or sending payment — you actively type something in or authorize a transaction.
Scanning a code and immediately closing the preview without going further carries meaningfully less risk than completing all seven steps. Evaluating a QR code means asking which of these steps you are actually being asked to take, not treating the whole sequence as a single act.
Built-in camera scanning versus third-party scanner apps
Current iPhones and various Android devices can decode QR codes through a built-in camera or system scanner without a separate app. Apple’s current instructions describe framing the code, then tapping the displayed link to open its content; Android interfaces differ by manufacturer, camera app, and system version. Check that your device shows decoded content before navigation rather than assuming every scanner behaves the same way. A third-party scanner adds software with its own permissions, settings, and update practices; the UK NCSC recommends using the scanner supplied with the phone.
Reading the destination before opening it
Whatever tool you use, read the previewed address the same way you would read any other link — see How to Read a URL: Every Part Explained in Plain English for how to identify the actual registrable domain rather than being misled by a brand name appearing elsewhere in the address. A shortened or truncated address in the preview hides the real destination the same way a shortened link does elsewhere; see How to Check Where a Shortened Link Goes Without Opening It for how to expand one before proceeding, and Lookalike Domains and Homograph Attacks: What to Check for how a convincing but unrelated domain can be constructed.
Physical tampering as a possible scenario
A QR code sticker can be placed over a legitimate one in a public location. The FTC specifically notes reports of scammers covering parking-meter codes with their own codes, while the UK NCSC discusses QR-related fraud in open spaces such as stations and car parks. Neither source makes a universal claim about every public code. A sticker that sits above the surface, shows visible adhesive edges, or is misaligned with surrounding material is a reason to stop and verify through the parking authority or business instead.
Payment and parking-meter examples
The following is a hypothetical scenario, not a documented real incident, used to illustrate the pattern described above. You approach a parking meter with a QR code sticker for payment. Before scanning: check whether the sticker looks consistent with the meter’s other signage, or appears to be placed over something else. After scanning, read the previewed destination — does it reference the actual parking authority for that city, or something unrelated? If anything looks inconsistent, paying through the meter’s own app or a physical payment method avoids the question entirely.
Restaurant-menu and delivery examples
A table tent or counter card can provide context about who placed a menu code, but physical proximity to a business does not prove that the sticker or destination is unchanged. Inspect the material and preview the domain; ask staff if the code appears altered or the address is unexpected. A code in an unsolicited delivery message or unexpected package deserves the same independent check. Opening the courier’s known app or typing its known site avoids relying on the code.
Account-login and multifactor-authentication examples
Some services use a QR code specifically to log in a new device or link it to an existing account, including certain multifactor-authentication setups. Because approving this kind of code can grant a new device ongoing access to your account, scan and approve a login-linking QR code only when you initiated that specific login attempt yourself — an unsolicited request to scan a code to “verify” or “restore” an account, arriving through a message rather than something you started, warrants the same caution as any other unsolicited request for account access.
Android and iPhone interface differences
Exactly how a destination preview is shown, and which native scanning tools are available, differs across Android manufacturers and versions, and has changed across iOS versions over time — this guide describes general patterns rather than identical behavior on every specific device. On any device, the underlying habit is the same regardless of the exact interface: look for a preview of the decoded content before you proceed, and read that preview the way you would read any link.
Why HTTPS does not prove the operator is honest
A padlock or similar indicator on the destination page confirms the connection to that page is encrypted; it does not confirm who operates the page or whether they intend to act honestly, since encryption certificates are widely available regardless of a site’s actual purpose. If the previewed destination is itself a further shortened link rather than a readable address, see How to Check Where a Shortened Link Goes Without Opening It before proceeding.
Why a familiar logo does not prove legitimacy
A payment page reached through a QR code can be styled to resemble a familiar brand or payment processor because visual elements can be copied. A professional-looking page is not, by itself, evidence that the page is genuine. Identifying the registrable domain helps isolate the relevant part of the address and compare it with a known official domain; it does not identify the real-world operator or prove intent on its own.
Why a warning system cannot guarantee safety
Some scanner apps and browsers warn about destinations their security service recognizes as harmful. Detection methods differ and can include reputation lists or other signals. A harmful page may not yet be recognized, and a warning can also be mistaken, so the presence of a warning is a reason to stop while the absence of one does not confirm safety.
Recovery: entering login credentials
Change that password immediately on the real site, reached independently rather than through the same code, and anywhere else the same password was used.
Recovery: sharing a verification code
Act immediately, since the code may have been the last barrier protecting the account — change the account’s password and review recent activity right away. See What to Do After Clicking a Suspicious Link for the fuller version of this and the scenarios below.
Recovery: entering card or banking information
Contact your card issuer or bank promptly to discuss disputing the charge or replacing the card number.
Recovery: sending payment
Contact your bank or payment provider immediately; whether a payment can be stopped or reversed depends on the method used and how quickly you act.
Recovery: downloading or installing an application
Uninstall the application, then run a full security scan, since some malicious apps install additional components alongside the app itself.
Recovery: installing a configuration profile
On Apple devices, a configuration profile can manage accounts, network settings, certificates, device-management behavior, or related data. Apple’s current guidance explains how to review and delete an unknown profile in VPN & Device Management and notes that removing it also removes its associated settings, apps, and data. If the device belongs to a school or employer, contact its administrator before deleting a managed profile. If an unknown profile cannot be removed or you remain concerned about other changes, contact Apple Support or a qualified technician rather than assuming a factory reset is automatically required.
Recovery: granting notification, accessibility, device-management, or other sensitive permissions
Revoke the specific permission through your device or browser settings, and treat this alongside any related app installation — removing the permission alone does not remove software that may have been installed separately during the same interaction.
A decision table for a code you are unsure about
| Observation | Reasonable response |
|---|---|
| Sticker appears tampered with or misaligned | Do not scan; use an alternative payment or access method |
| Preview shows an unrelated or unexpected domain | Do not proceed; verify independently |
| Code arrived unsolicited, asking you to “verify” or “restore” an account | Do not scan unless you initiated the login yourself |
| Code provided directly by a business you are visiting, destination matches expectations | Proceed with ordinary caution |
Limitations
None of the checks in this guide settles the question alone. A destination can read correctly, use HTTPS, and still be fraudulent if you cannot independently verify the business behind it; a warning system may not recognize a new harmful destination. Use the checks together with the broader link-safety habits described in How to Read a URL: Every Part Explained in Plain English.
Questions and answers
Is scanning a QR code by itself risky?
In a camera flow that displays decoded content for you to tap, scanning alone does not open, download, or install anything. A third-party scanner may behave differently, so confirm its settings and inspect the proposed action before continuing.
Should I avoid QR codes entirely?
That is not necessary for the many legitimate, everyday uses of QR codes. Applying the preview-and-verify habit described here, rather than avoiding QR codes altogether, addresses the actual risk without giving up a genuinely convenient technology.
What if I cannot tell whether a code has been tampered with?
If you cannot be reasonably confident a code is genuine, using an alternative method — the business’s own app, a staff-assisted option, or typing a known address directly — avoids the question entirely.
