Are QR codes safe?

What a QR code can and cannot do

A QR code is a way of writing text as a pattern. At maximum it holds around 3,000 characters — nowhere near enough for a program, and phones do not execute code from a camera anyway.

So a QR code cannot:

• Install anything by itself.
• Access your files, contacts or messages.
• Do anything at all without you tapping the prompt that follows.

What it can do is take you somewhere. That is where every genuine risk lives.

The real risk: you cannot see the destination

A written link shows you `paypal-secure-login.example.com` before you click. A QR code shows you a square. That opacity is the whole attack surface.

The technique has a name — quishing, QR phishing — and it works for two practical reasons. Printed codes hide their destination completely. And in email, a code is an image, which slips past filters that would flag the same link written as text.

Common versions:

• Fake parcel notices — "scan to reschedule delivery", leading to a card-details form.
• Parking and EV charging — stickers over legitimate payment codes on meters and chargers.
• Workplace emails — "scan to re-authenticate your account", pointing at a convincing login page.
• Fake WiFi — a code joining a network the attacker controls rather than the café's.

How to check one in two seconds

Both iPhone and Android show the destination in a banner before opening it. Most people tap through without reading it. Reading it is the entire defence.

1. Read the domain, specifically the part just before the first single slash. In paypal.com.secure-login.xyz/verify the real domain issecure-login.xyz, not PayPal.
2. Be suspicious of shorteners. A bit.ly or unfamiliar redirect hides the real destination behind another layer.
3. Never enter credentials from a scan. If a code leads to a login, close it and navigate to the site yourself. This single habit defeats nearly all quishing.
4. Check the physical code. Feel for a sticker edge. A code that looks newer or differently printed than the sign around it deserves suspicion.

Where scepticism is warranted

• Unsolicited post and email. A code arriving unasked, especially with urgency attached, is the classic pattern.
• Anything asking for payment or login. Legitimate organisations rarely need you to authenticate from a scan.
• Public payment terminals. Parking meters and chargers are the most-targeted physical surfaces because the payment step feels normal.
• Urgency. "Your account will be closed" is social engineering regardless of how it reaches you.

If you are the one making codes

You can make yours easier to trust:

• Point at your own domain. When people preview the destination, they should see a name they recognise — not a redirect service.
• Print the address alongside. It gives cautious people a way to reach you without scanning, and signals you have nothing to hide.
• Say where it goes. "Scan to see our menu" beats a bare square.
• Protect physical codes. Laminate or seal them, and check periodically that nobody has stuck something over them.
• Never send codes to a login page. Even legitimately, it trains people into the habit that quishing depends on.

This is one of the underrated arguments for static codes. A code encoding your real address isinspectable — anyone can decode it and see exactly where it goes. A code that routes through a third-party redirect is opaque by design, which is the same shape as the attack.

Keeping it in proportion

QR codes are not dangerous in the way the occasional headline suggests. They are a display format for text, and billions are scanned harmlessly. The risk is ordinary phishing wearing a new costume, and the defence is the ordinary one: read where you are going before you enter anything.