Is It Safe to Scan Random QR Codes?

This guide explains the scams, the warning signs, and the habits that keep you safe.

QR codes are convenient precisely because you cannot read them with your eyes — you scan, and your phone does the rest. That convenience is also the weakness. A criminal does not need to write a convincing email or build a fake website that you visit on purpose. They only need to put a bad web address inside a code, and let your phone open it for them. The scam even has a name: quishing, short for QR phishing.

What is quishing?

Quishing is phishing that swaps the clickable link for a QR code. The code itself is harmless — a pattern of squares that encodes a bit of text. Scanning it cannot infect your phone, and nothing happens until you tap the link it shows you. The danger starts after that tap: a fake website that looks like your bank, a delivery company, or a login page, and captures what you type; a malware download, such as an app installed from outside the official store; or a payment redirected to a criminal's account.

Law-enforcement and consumer-protection agencies have warned about this for years. The FBI's Internet Crime Complaint Center warned in January 2022 that criminals tamper with QR codes — placing a sticker over a real code, or sending a fake code by text or email — so victims are sent to sites that steal login and financial information, or to malware and redirected payments. The US Federal Trade Commission warned in December 2023 about the same patterns, including codes placed over real ones on parking meters and codes sent with a made-up reason to scan, such as a failed delivery or a problem with your account.

The common QR code scams

• The sticker over the real code. The most widely reported scam is physical: a printed sticker placed over the genuine code on a parking meter, a restaurant table, or a poster. You think you are paying for parking; the money goes to a criminal.
• The fake delivery or account message. A text or email claims a parcel failed, an account will be locked, or a payment bounced — and the only way to fix it is to scan the attached code. The urgency is the trick: it stops you checking.
• The payment-only demand. Messages that insist you can only pay by scanning a QR code are a red flag. Legitimate companies offer more than one way to pay.
• The crypto "scan to connect" trick. A code that asks you to connect your crypto wallet can link it to an app that drains it. Never approve a wallet connection from a code you did not go looking for, and never share a seed phrase, private key, password, or one-time code.
• The fake Wi-Fi or login page. A code that promises free Wi-Fi or a quick login can open a page that harvests your credentials. If the page asks you to log in, stop — a QR code should never be the reason you enter a password.

Red flags to check before you tap

Your phone shows you the destination before you open it. Use that pause — it is the whole defence:

• Did you expect this code? A code you went looking for — one you asked a cashier to show you, or printed on a bill you already hold — is low risk. A code that arrived unexpectedly, by text, email, or a sticker in public, is not.
• Does the address match the brand? Read the web address your phone shows you. A malicious address often differs from the real one by a single letter, an extra word, or a different ending — scanner-cam-support.com is not scanner.cam.
• Is there urgency? "Scan now or your account closes" is a pressure tactic, not a real deadline. Real companies do not lock accounts over a QR code.
• Does it ask for a login or a payment? A menu, a timetable, or a product page is normal. A login form or a payment page reached from a random code is not.
• Is the physical code tampered with? On a parking meter, poster, or restaurant table, look for a sticker placed over the printed code, or a code that looks newer than everything around it.

Seven habits that protect you

1. Use your phone's built-in scanner. The FBI advises against downloading separate QR scanner apps, which can themselves be a risk. Your camera app, Photos, or Google Lens already does the job.
2. Read the preview address every time. Never tap a link you have not read. If the address looks wrong, close it.
3. Type the address yourself for anything important. For payments and logins, open the company's app or type their web address by hand instead of following a code.
4. Never pay through a page a QR code opened. If a code leads to a payment screen, stop and use the company's official app or website instead.
5. Do not scan codes in unexpected messages. A QR code in a text or email you did not ask for is the single biggest warning sign.
6. Keep your phone updated. Security updates patch the flaws that malicious pages try to exploit.
7. Check physical codes for tampering. If a code on a meter or poster looks stuck on, do not scan it — pay another way and tell the business.

What to do if you already scanned one

If you scanned a code and tapped through, do not panic — but act quickly. If you entered a password, change it now, from the company's official app or website, not from any link in the message. If you entered payment details, contact your bank and watch for transactions you do not recognise. If you downloaded an app from outside the official store, delete it and run your phone's security scan. Then report it: in the US, the FTC accepts reports at ReportFraud.ftc.gov and the FBI at ic3.gov. Reporting helps the next person who gets the same code.

Frequently asked questions

Is it safe to scan random QR codes?
Scanning itself is safe — reading a code cannot infect your phone. The risk is the destination: a random code can hide a phishing link, so check the web address before tapping, and never enter passwords or pay through a page a random code opened.

Can scanning a QR code hack my phone?
Scanning alone should not. Your camera reads the text and shows you a preview — nothing happens until you tap. The dangers start after that tap: fake websites, malware downloads, or payments redirected to a criminal's account.

What is quishing?
Quishing is QR phishing: a scammer hides a malicious web address inside a QR code, you scan it, and your phone opens a fake login page or payment form. The FBI and the FTC have both warned about it — the FBI in a January 2022 public service announcement, and the FTC in a December 2023 consumer alert.

Are QR codes on parking meters safe to scan?
Not always. Criminals place stickers over genuine codes on parking meters, so the scan sends you to a fake payment page. Check the code for tampering, read the address before paying, and use the official parking app or a typed web address when you can.

What should I do if I scanned a malicious QR code?
If you entered a password, change it immediately from the company's official app or website. If you entered payment details, contact your bank and watch for unfamiliar transactions. Delete any app you installed from outside the official store, and report the code to the FTC at ReportFraud.ftc.gov or the FBI at ic3.gov.

Sources: FBI Internet Crime Complaint Center, "Cybercriminals Tampering with QR Codes to Steal Victim Funds", Public Service Announcement I-011822-PSA, January 2022 (ic3.gov/PSA/2022/PSA220118); US Federal Trade Commission, consumer alert on QR code scams, December 2023.

Related guides

• How to Scan a QR Code from a Screenshot
• How to Scan QR Codes With Your Phone Camera (No App)
• Is It Safe to Scan Documents Online?
• How to Scan Documents With Your Phone Camera