Guide
Are QR codes safe?
A QR code is text. It cannot install anything by itself. The risk is entirely in what the text points at — and in the fact that you cannot read it before you go there.
Short answer
QR codes cannot install malware by themselves — they contain text, and scanning displays or opens it. The real risk is that the destination is hidden until you scan, which attackers exploit by placing fraudulent codes over legitimate ones. Checking the domain before acting removes most of the risk.
Contents
What a code can do
The actual capabilities
| A QR code can | A QR code cannot |
|---|---|
| Open a website | Install software without your consent |
| Prefill an email, message or dialler | Send anything automatically |
| Join a Wi-Fi network after a prompt | Access your files or photos |
| Add a contact or calendar entry after a prompt | Read your passwords |
| Open a payment app with details prefilled | Complete a payment without confirmation |
| Display plain text | Run code on your phone |
Every action requires a confirmation step. The danger is not the code executing something — it is you approving something you did not fully understand.
Quishing
How the attacks actually work
Quishing — QR phishing — exploits the one property that makes codes useful: they are unreadable to humans. You cannot check a destination you cannot see.
The patterns that recur:
- Sticker overlays. A fraudulent code stuck over the real one on a parking meter, EV charger or ticket machine. The victim pays a convincing-looking clone.
- Postal and email lures. Letters or emails appearing to be from a bank, tax authority or delivery company, with a code leading to a credential-harvesting page. Codes are used specifically because email security filters inspect links and not images.
- Fake table cards. Restaurant tables with an added code offering a discount, harvesting card details.
- Charity and donation codes in public places, redirecting to an attacker's payment page.
- Unsolicited packages containing a code, exploiting curiosity about an unexpected delivery.
Checking
A routine that takes ten seconds
- Look at the physical code. Is it a sticker over something else? Are the edges lifting? Is the print quality different from the surrounding material? On public infrastructure, a sticker is the whole tell.
- Decode before you go. Photograph it and use the reader, which shows the destination without opening it.
- Read the domain, right to left. The real domain is the part immediately before the first single slash.
yourbank.com.secure-login.xyzissecure-login.xyz, not your bank. - Apply the usual rules. Do not enter credentials or card details on a page you reached from a code. Navigate to the site yourself instead.
- Treat urgency as a warning. Fines, account suspensions and expiring offers are pressure tactics, not deadlines.
For publishers
Reducing the risk for your own customers
- Print your domain in readable text next to every code, so people can verify where it should go.
- Use your own domain rather than a third-party shortener. Customers cannot verify
qrs.ly/a1b2, and neither can security filters. - Laminate or engrave codes on public equipment so a sticker is visibly wrong.
- Check installations physically on a schedule. Overlay attacks are found by looking, not by monitoring.
- Never ask for payment card details on a page reached only by scanning a code — you are training your customers into the exact behaviour that attackers rely on.
Questions
Frequently asked
Can a QR code give my phone a virus?
Not by itself. A code contains text; it cannot execute anything. Risk comes from the site it opens or the file you then choose to download.
What is quishing?
Phishing using QR codes. Because the destination is hidden until scanned, and because images bypass many email link filters, codes are an effective delivery method for fraudulent links.
How can I see where a QR code goes before opening it?
Decode it with a reader that shows the payload rather than following it. Many phone cameras also preview the URL before you tap.
Are QR codes on parking meters safe?
Treat them with suspicion — meters and chargers are the most common target for sticker overlays. Use the operator's own app, and check whether the code is a sticker.
Is it safe to scan a QR code from a letter?
Only if you can verify the sender independently. Codes in postal mail claiming to be from banks or tax authorities are a growing fraud channel.
Last reviewed 24 August 2026 · Written and reviewed by the QR Code Builder team