What Is a QR Code and Are They Safe to Scan?
A QR code is just a web address or text encoded as a pattern. Scanning is harmless; following the link is where the risk lives.
In short
A QR code is a two-dimensional barcode that stores text, most often a web address. Scanning one only reads that text; nothing happens until you open the link. The risk is that a code can point anywhere, and criminals stick fraudulent codes over genuine ones on parking meters, menus and posters. Always read the address your phone shows before tapping, and be wary of codes that lead to payment or login pages.
QR codes went from novelty to infrastructure in a few years, and the security questions arrived at the same time. The technology is harmless. The thing it points to is where attention belongs.
What a QR code is
A grid of black and white squares encoding up to a few thousand characters of text. Most encode a web address, though they can hold Wi-Fi credentials, contact details, a payment request or plain text. The three large squares in the corners let the camera find and orient the code; the pattern inside carries the data with enough redundancy that a partly damaged code still reads.
Scanning one is the same as typing the address it contains. Nothing more happens at the scan.
Where the risk is
The code is a shortcut to a link, and the link can go anywhere. The attack that actually occurs is simple: someone prints a QR code that leads to a fake payment or login page and sticks it over a real one.
Parking meters are the most reported case. A driver scans what looks like the council’s code, lands on a convincing payment page, and enters card details. Restaurant menus, charity posters, bike hire and fake delivery notices have all been used the same way. The genuine code is often still there underneath the sticker.
Codes in emails and messages carry the same risk as any link, with the added disadvantage that the address is not visible until you scan.
How to check before you tap
Modern phone cameras show the destination as a small banner before opening it. Read it.
- Does the domain match the organisation? A council payment page will be on the council’s domain, not a short link or an unfamiliar address.
- Is it a shortener such as bit.ly? Shorteners hide the destination and are a mild warning sign on anything involving money.
- Does the sticker look added? Slightly misaligned, a different print quality, or covering part of the original artwork.
If the code leads to a page asking for payment or a login, and you did not expect that, stop. Go to the organisation’s app or website directly instead.
Making your own
If you are generating QR codes for a menu, a poster or a business card, the choice that matters is whether the code contains the address directly or points at a redirect service.
A direct code is fixed: it contains the URL and nothing else. A redirect code contains the generator’s URL, which then forwards to your destination. Redirects can be edited later, which is convenient, but they also mean your code depends on a third party staying in business and honest, and some free services later replace the destination with adverts.
For anything permanent, generate a direct code on your own device.
The short version
Scanning is safe. Reading the address before opening it is the whole precaution. And any QR code that leads to a request for money or a password, without you having initiated something, deserves the same suspicion as an unexpected email asking for the same.
Common questions
Can scanning a QR code infect my phone?
Not by itself. The scan decodes text. Harm only comes from acting on that text: opening a malicious site, downloading an app from outside the official store, or entering details on a fake page. Modern phones show the destination before you commit.
Why are QR codes used for menus and parking?
They replace typing a long address with a single scan, and they can be printed anywhere. The convenience is real. It is also exactly why a fake sticker placed over a genuine code works so well.
How do I make a QR code safely?
Use a generator that creates the code on your own device rather than one that stores the destination on a server and redirects through it. A code that redirects through a third party can be changed later without your knowledge.
Sources
Every factual claim above traces to one of these. Follow them rather than taking this article's word for it.
- Phishing scams National Cyber Security Centre
Try it yourself
Free, instant, and nothing you enter leaves your browser.