Are QR Codes Safe? What to Check Before You Scan

Phishing is any trick that gets you to hand over passwords, payment details, or personal information by pretending to be someone you trust. Quishing is the same trick delivered through a QR code. It works well for attackers for a few reasons:

• You can't read a QR code with your eyes, so you can't judge the link before scanning it the way you might hover over a link in an email.
• Scanning happens on a phone, where the address bar is small and easy to ignore.
• Email security filters scan links in text but often can't read a link hidden inside an image.
• People associate QR codes with ordinary tasks — menus, parking, deliveries — so they don't feel risky.

Real-world examples

These are patterns that police, consumer protection agencies, and banks in the US, UK, Canada, and Australia have publicly warned about:

• Fake parking stickers. Councils and cities in the UK and police departments in several US states have reported stickers placed over legitimate pay-and-display codes, leading to look-alike payment sites.
• Fake delivery notices. A card through the letterbox or a text claims a parcel couldn't be delivered and asks you to scan to reschedule — and pay a small fee.
• Email quishing. Messages styled as Microsoft 365, DocuSign, or HR notices tell you to scan a code to "re-verify" your account. Because the link is in an image, it slips past filters and moves the attack from your protected work laptop to your personal phone.
• Fake fines and tax notices. Letters impersonating tax agencies or toll operators include a QR code to pay an "outstanding balance".
• Restaurant and event codes. Swapped stickers on tables or posters can redirect to fake ordering or ticket pages.

In almost every case, the goal is the same: get you to type a password or card number into a page that looks right but isn't.

The good news is that a few seconds of attention catches most scams. Here's my checklist.

Before scanning

• Is it a sticker on top of a printed sign? Run a finger over it. Layered, crooked, or peeling stickers on parking meters, EV chargers, and posters are the classic sign of tampering.
• Did it arrive unexpectedly? A QR code in an email, text, or letter you weren't expecting deserves suspicion, especially if it mentions urgency, fines, or account problems.
• Is there a reason to use a code at all? If you can type the company's address yourself or open its official app, do that instead.

After scanning, before tapping

Most phone cameras show a preview of the link before opening it. That preview is your best defense. Look for:

• A misspelled or look-alike domain, such as "paypa1", "amaz0n-support", or extra words added to a brand name.
• A link shortener that hides the real destination. Shorteners aren't always malicious, but they remove your ability to judge the link.
• An unusual domain ending or a long string of random characters.
• A site that immediately asks you to log in, enter card details, or download an app.

A legitimate parking or menu page rarely needs your email password. If a page asks for something that doesn't fit the task, close it.

If you're on the other side — printing a code for your business, event, or Wi-Fi — how you create it matters too. Many free online QR generators don't put your link directly in the code. Instead, they encode their own short redirect link and forward visitors to your page.

That setup causes problems:

• The generator can see and log every scan, along with visitors' IP addresses and devices.
• Some services make the code stop working after a trial period unless you pay, breaking printed menus and flyers.
• If the service shuts down or is compromised, every code you've printed can be redirected somewhere else.
• For Wi-Fi codes, you're typing your network password into someone else's website.

Our QR Code Generator builds a static code entirely in your browser. The exact link or text you enter is what goes into the image — no redirect, no tracking, no expiry, and nothing uploaded. If you'd like codes that match your branding, the Artistic QR Code Generator adds colors and a logo the same way.

When you print a code, add the destination in plain text underneath, such as "menu.yourcafe.com". It lets careful visitors confirm where they're going and makes swapped stickers easier to spot.

A Wi-Fi QR code is one of the most useful codes you can make. Guests scan once and connect, no spelling out a long password. It does put your network password into a picture anyone can photograph, so a little care goes a long way.

1. Use a separate guest network. Most home routers and all business routers support one. It keeps visitors' devices away from your computers, printers, and smart-home gear.
2. Set a strong guest password. Since nobody has to type it, it can be long and random. Generate one with our Password Generator.
3. Choose WPA2 or WPA3 security in the code settings to match your router.
4. Create the code on your device, not on a website that receives your password.
5. For a home, keep the printout somewhere guests see it but passersby don't — inside, not in a front window.
6. For a business, change the guest password periodically and reprint the code. Old codes stop working, which also cuts off former staff and regular freeloaders.

Scanning alone rarely causes harm. What matters is what you did afterward. Work through the steps that apply.

If you only opened the page

• Close the tab and clear recent browsing data if you like.
• Make sure your phone's operating system and browser are up to date, since updates patch the rare flaws a page could exploit.

If you entered a password

1. Change that password immediately from the official app or by typing the site's address yourself.
2. Change it anywhere else you used the same password.
3. Turn on two-factor authentication for the account.
4. Check recent login activity and sign out other sessions if the site offers that option.

If you entered card or bank details

1. Call your bank or card issuer using the number on the back of your card and ask them to block the card.
2. Review recent transactions and dispute anything you don't recognize.
3. Watch for follow-up calls or texts pretending to be your bank — scammers often try a second round.

If you installed an app

Uninstall it, check that it doesn't have device administrator or accessibility permissions, and run your phone's built-in security scan. If in doubt, back up your photos and reset the device.

Report it

Reporting helps others. In the US, report to the FTC at ReportFraud.ftc.gov. In the UK, forward suspicious emails to report@phishing.gov.uk and report fraud to Action Fraud. In Canada, use the Canadian Anti-Fraud Centre, and in Australia, Scamwatch. Tampered parking or council signs should also be reported to the operator so they can remove the stickers.

Can scanning a QR code hack my phone?

Scanning on its own is very unlikely to compromise an up-to-date phone. The danger comes from the page you open and what you enter or install there. Checking the link preview before tapping prevents most problems.

Are QR codes in restaurants safe?

Usually, yes. Check that the code is printed on the menu or table card rather than stuck on top, and that the link preview shows the restaurant's name or a well-known ordering service.

Do I need a special app to scan QR codes safely?

No. The built-in camera on iPhone and Android shows the link before opening it. Avoid third-party scanner apps full of ads; some have been caught collecting data.

Can a QR code expire?

A static code that contains your link directly never expires. Codes made by redirect services can stop working if the service ends or your plan lapses, which is why generating static codes locally is the safer choice.

Is it safe to share my WiFi with a QR code?

Yes, if you use a guest network with its own strong password and generate the code on your own device rather than through a website.