FreeurlIs it safe to scan a QR code? Mostly yes. Pointing your camera at a code does very little by itself. The danger starts when the code opens a fake page and you type a password, a card number or a payment into it.
So the useful question is not "Is scanning safe?" It is "Do I trust where this code is taking me?" This guide shows you how to answer that in about ten seconds, which scams are active right now, and what to do if you already scanned a bad one.
What actually happens when you scan a QR code?
A QR code is just a picture of text. Most of the time that text is a web address. Your camera reads the picture, turns it into the address and offers to open it. Nothing runs until you tap.
That is why the scan itself is low risk. The risk sits in three places after the scan:
- The page it opens. A fake login or payment page that looks real.
- What you enter. Passwords, card details, a code from a text message.
- What you install. An app or file the page pushes you to download.
The FBI's Internet Crime Complaint Center has warned that criminals tamper with QR codes to send people to sites that harvest login and financial details, and that a malicious code can also lead to malware. You can read the alert on the IC3 site. It is from January 2022, and the advice in it still holds.
How do QR code scams work?
Almost every QR scam is a version of the same trick: you cannot read a QR code with your eyes, so you cannot tell a real one from a fake. Scammers use that. The security term is quishing, which means phishing with a QR code.
A fake code stuck over a real one
In September 2026 the FTC published an alert that people had reported scammers covering the real QR codes on parking meters with their own. Scan the fake one and you land on a site built to steal money, personal information, or both. You can read the FTC alert for yourself.
The same trick works on restaurant tables, event posters, flyers and charging stations. Anywhere a code is printed on a surface that a stranger can reach, a sticker can be placed over it. Our guide on how to spot a fake QR code sticker covers the physical checks.
A code you did not ask for
Codes also arrive by email, text or mail. The story is usually urgent: a package could not be delivered, an account will be closed, a payment failed. The IC3 alert describes one version, a "failed payment" email that says you can only pay by scanning a code. A real company will not insist on that.
A real code that points to a risky link
Sometimes the sticker is not fake. The code is genuine, but it points to a short link that redirects somewhere you did not expect. Short links are not dangerous on their own, but they hide the final address. See are short links safe for how to check where one leads.
What should you check before you tap the link?
You do not need a security course. You need a short routine. Run it every time the code is in a place you did not choose, or the page asks for something sensitive.
- Read the preview. Most phone cameras show the web address before they open it. Look at the domain, the part right before the first single slash. A real parking operator should show its own name, not a string of random letters.
- Look for swapped or extra letters. The FTC and the FBI both say to check for spelling mistakes and switched letters in the address. Something like paymnet or an extra word tacked on is a warning sign.
- Check the sticker. Run a fingernail over the edge. A code on a different type of paper, or one that lifts, may be placed over the original.
- Ask what the code wants. A menu should show a menu. If it jumps straight to a login, a payment or an app download, stop.
- Use another route for money. For a payment, type the company's known web address yourself or use its official app instead of the code. The IC3 alert suggests this too.
- Do not install apps from a code. Go to your phone's app store and search for the app by name.
If you want a worked example: you park downtown and the meter has a sticker that says "Scan to pay." The preview on your phone reads something like cityparking-pay.example, but the signs around you name a different parking company. That mismatch is enough. Skip the code, walk to the pay station or open the operator's official app, and pay there.
Do you need a QR scanner app?
No. The IC3 alert specifically advises against installing a scanner app, because the phone's built-in camera can already read codes. Third-party scanner apps add one more thing to trust, and some are stuffed with ads. Use the camera app.
Is a QR code on a business card, menu or product box safe?
It depends on who controls the surface. A code printed on a box or a menu that came straight from the business is usually fine. A code on a public sticker, a flyer pinned to a board or an unsolicited letter deserves the full check above.
Context also matters. A code that opens a restaurant menu is low stakes. A code that asks you to sign in, pay a fee or verify your identity is high stakes. Raise your guard in proportion to what the page asks for.
What if you already scanned a bad QR code?
Do not panic. If you only scanned it and closed the page, you most likely have nothing to fix. If you entered anything, follow the FTC's steps:
- Do not interact with the scammer. Do not reply to messages from the fake site or call numbers it gives you.
- Change your passwords. If you typed a username and password, change that password everywhere you use it.
- Review your statements. Check your card and bank accounts for charges you did not make, and call your bank at once if you see any.
- Report it. File a report at ReportFraud.ftc.gov. For losses online you can also file with the FBI at ic3.gov.
Be realistic about money. The IC3 alert notes that law enforcement cannot guarantee that lost funds can be recovered after a transfer. Speed with your bank matters more than anything else.
Keep your phone ready for the day you get it wrong
Two habits make a mistake much less costly. First, keep your phone's operating system and apps updated, as the FTC advises. Second, turn on multi-factor authentication on your email, bank and main accounts. If a fake page steals a password, the second step can still block the login.
A password manager helps too. It only fills a password on the real site, so if it does not offer your login on a page, that page is not the one you think it is.
If you share QR codes, make yours easy to trust
If you run a business or a project, you are on the other side of this. Your customers have been told to be careful, so give them reasons to trust your code. A few simple moves help:
- Put a short line of text next to the code that says where it goes, such as "Scan for the menu."
- Print the web address under the code so careful people can type it.
- Check your printed codes now and then to make sure no one has stuck something over them.
- Point the code to an address on a domain people recognize, ideally your own.
You can make a code for free with the Freeurl QR code generator. If you use a short link behind the code, you can also see how many people scan it. Our guide to tracking QR code scans walks through that setup.
One honest limit: no generator, ours included, can stop someone from physically sticking a fake code over yours. A short link and a visible web address make the swap easier to catch, but they do not prevent it. Checking your printed codes is still on you.
Frequently asked questions
The answers below are also in the FAQ section for quick reference.
The short version
Scanning is fine. Trusting blindly is not. Read the address your phone shows, be wary of codes in public places or in messages you did not expect, never pay or log in through a code you cannot verify, and keep your phone and accounts protected. Those few steps take less time than finding a parking meter again.
Frequently asked questions
Can you get a virus just by scanning a QR code?
Scanning alone rarely does anything. The code is just text, usually a web address, and nothing opens until you tap it. The risk comes from the page it opens, which could ask for your password or push you to install an app. The FBI's IC3 has warned that malicious codes can lead to malware, so avoid installing anything from a QR code.
How can I tell if a QR code is fake?
Read the web address your phone shows before opening it and look for misspellings, extra words or swapped letters. For printed codes, check whether a sticker has been placed over the original. Be careful with codes that jump straight to a login, a payment or an app download.
Do I need a QR scanner app?
No. Your phone's built-in camera can read QR codes. The FBI's IC3 advises against installing separate scanner apps.
What should I do if I scanned a scam QR code?
Do not interact with the scammer, change your password anywhere you reused it, check your card and bank statements for charges you did not make, and report it at ReportFraud.ftc.gov. If you lost money, contact your bank right away.