Are QR codes safe? How to scan without getting caught
A QR code is a link you cannot read. Read it before you open it.
In short
A QR code itself cannot harm your phone, but it can lead to a fake website that asks for a password or payment. Before opening, read the address your camera shows; be wary of stickers on parking meters and payment terminals, and of QR codes in unexpected emails or letters. Never enter bank details on a page reached through a code you did not expect.
Key takeaways
- The danger is the link, not the code.
- Read the address shown before tapping it.
- Stickers on meters and unsolicited codes are the main traps.
How QR scams work
Criminals print QR codes leading to imitation websites — of a parking operator, a bank, a delivery company — and stick them over real ones or send them by email and post. The page then asks for card details or a login. This is called “quishing”.
Before you scan
- On a parking meter, charger or terminal: check the code is not a sticker on top of another.
- In an email or letter you did not expect: go to the official website yourself instead.
- In a restaurant or shop: a code printed on the menu is safer than a loose sticker.
After you scan
Your iPhone camera shows the address before opening it. Read the domain: a single wrong letter, an unusual ending, or a link shortener hiding the destination are warning signs.
Codes that track you
Many QR codes, even legitimate ones, go through a redirection server that records each scan: time, approximate location, device. Codes you make yourself can avoid this by containing their content directly.
QR code generator: Wi-Fi, vCard, URL
A QR code that contains its own content: no redirect, no tracking, no expiry.
Open the tool