Are QR codes safe? Mostly — here's how to be sure

The code itself is inert — just data, like printed text. The risk is the same as any link: where it goes. QR scams work by hiding that destination behind convenience. Know the three real attacks and the three checks that beat them.

The actual scams ("quishing")

The sticker overlay: a fraudster's code pasted over the real one on a parking meter, EV charger or menu — leading to a fake payment page. The fake notice: flyers or emails with codes to "verify your account" — credential phishing with a QR instead of a link (it dodges email link-scanners). The bait drop: codes on random posters promising prizes, leading to malware-adjacent pages or subscription traps.

Three checks before you trust

1. Look at the URL before opening. Phone cameras show the domain in the banner — read it. Misspellings and odd domains (paypa1-secure.net) are the tell. Our reader shows full decoded content for anything suspicious.
2. Physical codes: check for overlays. A sticker on top of a sticker on a payment point is a red flag — peel-test official-looking codes on meters.
3. Never log in or pay on a page a random code opened. Navigate to the service yourself instead. Legitimate operators survive that; phishers do not.

What a QR code cannot do

Scanning alone cannot hack a phone, install anything or steal data — codes open things, they do not execute. Every harm requires you to act on the opened page. Pause there and you are safe.

For businesses printing codes

You are the trust target too: use codes pointing at your own domain (not shorteners — people rightly distrust bit.ly on a parking meter), brand the code with your logo, and check your public stickers occasionally for overlays. Codes made here encode exactly what you typed — generated in your browser, we never touch the data (privacy).