Is This QR Code Safe? How to Check Before You Scan
A QR code is text, not a program — it cannot carry a virus. The risk is where the link goes and what you do next. Here is how to check a code before you scan it.
Short answer: a QR code cannot give your phone a virus, because a QR code is not a program. It is a way of writing text as a pattern of squares. What can hurt you is where that text points and what you do when you get there.
That distinction matters, because a lot of writing on this subject gets it wrong in a way that makes people either frightened of every code or careless about the thing that actually costs them money. The real risk is ordinary phishing wearing a new coat, and the defence is a habit that takes two seconds.
What is actually inside a QR code
The format stores four kinds of data, and only four: numbers, letters and digits, raw bytes, and Japanese kanji. DENSO WAVE, who invented it, caps a single code at 7,089 numeric characters, 4,296 alphanumeric or 2,953 bytes. A web address is a few dozen characters of that.
There is no instruction set. Nothing runs. When your camera reads a code it decodes text, recognises that the text looks like a URL, and offers you a link. Every attack that follows is the same attack you would face from a link in an email: the website does the work, or you do it yourself by typing a password.
The honest edge case, since it does get raised: a code can encode arbitrary bytes, and a deliberately malformed one has in the past triggered bugs in the software doing the reading. That is a vulnerability in a scanner app, not a virus in the picture, and it is not how anybody is being defrauded today.
The habit that prevents nearly all of it
Read the address before you tap. That is the whole technique, and it works because the scam depends on you not doing it.
Read a web address from right to left
The part that decides where you are going is the last section before the first single slash. In paypal.com.secure-login.info/verify, the destination is secure-login.info. "paypal.com" is just a word somebody put at the front to make it look right.
So: find the first single slash, look immediately left of it, and read backwards to the previous dot. That is the domain. Everything to the left of it can say anything at all.
What a look-alike actually looks like
Rarely a wild fake. Usually a letter swapped, a hyphen added, a suffix changed — rnicrosoft for microsoft, .co where you expect .com, company-billing.com instead of company.com. The FTC's advice is exactly this: "If you see a QR code in an unexpected place, inspect the URL before you open it" and check that a familiar-looking address is not spoofed.
Shortened links tell you nothing
A code that resolves to a bit.ly or similar shortener hides its destination behind another hop. On a poster that is often just laziness. On a payment request it removes the one check you were going to make, and is reason enough to find another route.
Check the sticker before you check the link
The most common physical version of this scam needs no technology at all: a printed sticker placed over a real code.
The FTC reports scammers "covering up QR codes on parking meters with a QR code of their own". The tell is physical: a sticker with an edge you can catch a fingernail under, a code sitting slightly crooked on a printed panel, a different paper finish, a code covering part of the surrounding text.
Where it happens matters too. The UK's National Cyber Security Centre draws a useful line: "The QR codes used in pubs or restaurants are probably safe for you to scan. Scanning QR codes in open spaces (like stations and car parks) might be riskier." A code on a laminated menu handed to you by staff has a short chain of custody. A code on a post in a car park has none.
One thing worth checking locally rather than assuming: not every city takes parking payment by QR code at all. If yours does not, a QR code on the meter is not a scam risk — it is simply a scam.
Previewing where a code goes
Both major phones show you the destination before opening it, if you look.
On iPhone, point the Camera app at the code and a banner drops from the top of the screen showing the domain. Read that banner. It is the entire safety mechanism, and it is doing its job even when people tap straight through it.
On most Android phones, the camera or Google Lens shows a preview with the address before opening. Behaviour varies between manufacturers and Android versions — some skins show more of the URL than others — so check what yours does on a code you trust before you need it.
Use the scanner built into the phone rather than one from an app store. The NCSC recommends exactly that: "use the QR-scanner that comes with your phone, rather than using an app downloaded from an app store". Third-party scanners add a party you did not need, sometimes open links without showing them, and are themselves a common vehicle for adware.
Three places to be more careful
In an email or message you were not expecting. This is quishing — phishing that uses a QR code so the link is a picture rather than text, slipping past filters that scan for bad links. Treat it exactly as you would a suspicious link: if the message is unexpected and wants you to log in, it is suspect regardless of the format.
In a package you did not order. The FBI has warned that criminals "send unsolicited packages containing a QR code that prompts the recipient to provide personal and financial information or unwittingly download malicious software". An unexplained parcel with a card saying to scan for details is the scam, not a delivery problem.
Anywhere you are asked to pay or sign in. A code that leads to a login page or a payment form deserves a second look every time, because that is where the money is.
When to ignore the code entirely
For your bank, a government service, an airline or anything holding your money, do not scan — type the address yourself, or open the app you already have. It takes ten seconds longer and removes the entire class of problem. No legitimate bank will mind.
This is also the answer when a code arrives by email claiming to be from one of them.
So can a QR code give your phone a virus?
No, and it is worth being precise about why, because the wrong version of this answer leads to the wrong precautions.
Scanning a code does not run anything. It shows you a link. Something still has to open that link, and then either a website has to exploit your browser — rare, and what updates are for — or you have to type credentials, or you have to install something and grant it permission.
Articles claiming that "malicious JavaScript executes the moment you scan" are describing something that does not happen. Keeping your phone updated and reading the banner covers the realistic risk.
Worth keeping in proportion, too. The NCSC notes this kind of fraud is "relatively small compared to other types of cyber fraud". Refusing to scan anything is not a security posture; reading the domain is.
If you already scanned one
Work out what actually happened, and respond to that rather than to the fright.
You opened the page and nothing else. Almost certainly nothing has happened. Close it. Do not enter anything.
You entered a password. Change it now, on the real site, reached by typing the address. Change it anywhere else you reused it, and turn on two-factor authentication while you are there.
You entered card details. Contact your bank immediately and say the card is compromised. Freezing or replacing a card is routine and they will not think it unusual.
You installed something. Remove it. On Android, uninstall the app and check whether anything was granted accessibility or device-admin permissions. iPhones rarely install anything this way unless a configuration profile was accepted — check Settings for one and remove it.
Then report it. Tell your national fraud reporting body — ReportFraud.ftc.gov in the US, Action Fraud in the UK, and your local equivalent elsewhere. Also tell the business whose code was covered, if there was one: a café or a car park operator generally has no idea a sticker has been placed on their sign, and cannot remove it until somebody says so.
The same reasoning applies from the other side of the camera: a WiFi QR code carries your network password in the pattern itself, readable by anyone who scans it — which is why the guest network, not the main one, belongs in a printed code.
If you are the one making QR codes
The same logic in reverse. People are getting more careful, so make your code easy to trust.
Point it at your own domain. Not a shortener. The whole check a cautious person runs is reading the domain, so give them one that makes sense.
Say where it goes. Print the destination beside the code in readable text. It costs nothing and removes all doubt.
Print it so tampering shows. A code printed as part of the artwork is harder to cover convincingly than one on a stuck-on label.
Check your own signage. If you have codes in public, look at them periodically. You are the only person positioned to notice a sticker.
The free QR code generator makes a static code that points wherever you tell it, with no redirect service in between — which means the address a visitor reads in their camera banner is your address, not a shortener's.
The short version
A QR code holds text, so it cannot carry a virus. Read the domain in your phone's banner before tapping, taking the part just left of the first single slash. Check whether a code in a public place is a sticker. Type the address yourself for anything involving money. And if you already scanned something and only looked at the page, you are almost certainly fine.
FAQs
No. A QR code stores text — numbers, letters, raw bytes or kanji — and nothing in the format can execute. Scanning one decodes text and usually offers you a link. Anything harmful happens afterwards: at the website the link opens, or because you typed a password or installed something. Keeping your phone updated and reading the address before tapping covers the realistic risk.
Your phone already shows you. On iPhone, the Camera app drops a banner from the top of the screen showing the domain — read it before tapping. On most Android phones the camera or Google Lens shows a preview with the address, though the amount shown varies by manufacturer. Try it on a code you trust so you know what yours displays.
Yes, and it is safer than using a downloaded scanner app. The built-in camera shows you the destination and waits for you to tap. The UK's National Cyber Security Centre specifically recommends using the scanner that came with your phone rather than one from an app store.
No. It adds a company between you and the link, some open addresses without showing them first, and QR scanner apps are a well-known vehicle for adware. Every current phone reads QR codes with its own camera, which is the safer option.
Treat them the way you would treat a link in the same email. Putting the link inside a picture is precisely why attackers use QR codes in email — it slips past filters that scan text for bad addresses. This is called quishing. If the message is unexpected and wants you to log in or pay, do not scan it; go to the site by typing the address.
Look at it physically before scanning. An edge you can catch a fingernail under, a code sitting slightly crooked on printed artwork, a different paper or finish, or a code covering part of the surrounding text are all signs something was stuck on top. Codes in open public places such as car parks and stations are riskier than one on a menu handed to you by staff.
Change that password now on the real site, reached by typing the address rather than following any link. Change it anywhere else you used the same one, and turn on two-factor authentication. Then report it to your national fraud reporting body, and tell the business whose code was covered if there was one — they usually have no idea.
Not from the scan itself. Opening a link does not hand anyone control of your phone. A compromise needs something further: a browser vulnerability that an update would have closed, an app you installed and granted permissions to, or credentials you typed in yourself. If you scanned something and only looked at the page, you are almost certainly fine.
Generally yes. The NCSC's own guidance is that codes used in pubs and restaurants are probably safe to scan, because the chain of custody is short and staff would usually notice something stuck over their own signage. The riskier places are unattended public surfaces such as parking meters, station posters and car parks.
