QR codes are everywhere now. Restaurants use them for menus, parking meters use them for payments, businesses use them for promotions, and you’ll even find them on packages and signs.
Most are perfectly legitimate.
The problem is that a QR code can hide where it’s actually sending you until you scan it. That makes a QR code scam surprisingly easy to pull off.
Criminals can create QR codes that lead to fake websites designed to steal passwords, payment information or other personal information. In some cases, all they have to do is place their fake QR code over a legitimate one.
Here’s what you should know before pointing your phone at the next random square you see.
How Does a QR Code Scam Work?
A QR code is essentially a shortcut to information, often a website address.
Your phone scans the code and gives you the option to open the destination.
The problem is that you can’t simply look at a QR code and know where it leads.
A scammer can create a code that sends you to a convincing copy of a legitimate website. You might think you’re paying for parking, signing into an account or viewing a restaurant menu when you’re actually entering information into a fraudulent website.
This type of scam is sometimes called “quishing,” a combination of QR code and phishing.
1. Be Careful With QR Codes in Public Places
A QR code attached to a physical object deserves an extra second of attention.
Parking meters, signs, restaurant tables, flyers and public kiosks can potentially be altered.
Before scanning, look closely at the QR code.
Does it appear to be an original part of the sign?
Or does it look like a sticker was placed over another QR code?
A sticker doesn’t automatically mean it’s fraudulent, but it’s a reason to verify before continuing.
2. Check the Website Before Opening It
Modern iPhones and Android phones generally show you information about the link before you open it.
Take a second to look at it.
Watch for:
- Misspelled company names
- Strange domains
- Unexpected URL-shortening services
- Random strings of characters
- A website that doesn’t match the business you’re dealing with
If you’re trying to pay for parking and the QR code sends you somewhere that has nothing to do with the parking company, don’t continue.
3. Don’t Enter a Password Just Because a QR Code Asked
Be particularly suspicious if scanning a QR code unexpectedly brings you to a login screen.
Instead of entering your username and password, close the page and open the company’s official app or website yourself.
This is especially important for:
- Banking accounts
- Apple or Google accounts
- Social media
- Workplace accounts
A fake login page can look remarkably similar to the real thing.
4. Be Suspicious of Unexpected Payment Requests
QR codes make payments convenient, which also makes them attractive to scammers.
Suppose you’re scanning a code to pay for parking, donate money or complete a purchase. Before entering credit card information, verify that you’re actually on the website you intended to visit.
Don’t assume a website is legitimate simply because it has the right logo.
Logos are very easy to copy. Humanity has somehow developed artificial intelligence while still being regularly defeated by copied-and-pasted logos.
5. Don’t Download an App From a Random QR Code
A QR code may direct you to download an app.
Instead of downloading software directly from an unfamiliar website, search for the company’s official app through Apple’s App Store or Google Play.
This gives you another opportunity to verify the developer and make sure you’re installing the correct application.
Be especially cautious if a website asks you to change security settings or install software from outside your phone’s normal app store.
6. Be Careful With QR Codes in Emails and Text Messages
QR codes aren’t limited to physical signs.
Scammers can put them in emails, text messages and attachments.
The message may claim:
- Your account has been locked
- A payment failed
- You need to verify your identity
- A package couldn’t be delivered
- Your password is expiring
- You have an unpaid bill
The QR code then sends you to a phishing site.
Treat an unexpected QR code the same way you’d treat a suspicious link.
7. Use the Camera App You Already Have
You generally don’t need to download a special QR code scanner.
Modern iPhones and Android phones can scan QR codes using their built-in camera software.
Using the phone’s built-in scanner also gives you an opportunity to preview the destination before opening it.
Downloading some random “Super Ultimate QR Scanner 2026” app just adds another unknown app with potential permissions to your phone.
What If You Already Scanned a Suspicious QR Code?
Simply scanning a QR code doesn’t necessarily mean you’ve been compromised.
What happened after you scanned it matters.
If you opened the website but didn’t enter information, close the page and avoid interacting with it further.
If you entered a password, change that password using the legitimate website or app. If you reuse that password anywhere else, change it there too.
If you entered credit or debit card information, contact your financial institution and monitor the account for unauthorized transactions.
If you downloaded an unfamiliar app, remove it and review your phone’s permissions and security settings.
QR Codes Aren’t the Problem
There’s no reason to stop using QR codes completely.
They’re useful technology, and the overwhelming majority you’ll encounter are legitimate.
The important thing is recognizing that scanning a QR code should be treated much like clicking a link.
You wouldn’t click every mysterious link someone emailed you.
A QR code shouldn’t get a free pass simply because the URL is wearing a little square disguise.
Public Technology Deserves Extra Caution
QR codes aren’t the only everyday technology worth thinking twice about when you’re away from home.
Airports, hotels, coffee shops and other public spaces are filled with convenient charging stations and unfamiliar networks.
If you travel frequently, read our guide on Why You Should Think Twice Before Using Public USB Charging Stations for another simple precaution worth knowing.
FAQ
Can Scanning a QR Code Hack My Phone?
Simply scanning a QR code generally isn’t the same as giving someone access to your phone. The bigger risk is following a malicious link, entering sensitive information, downloading something unsafe or granting permissions you shouldn’t.
How Can I Tell If a QR Code Is Fake?
You usually can’t determine whether a QR code is safe simply by looking at the pattern. Inspect the physical code for signs of tampering and preview the destination before opening it.
Is It Safe to Scan Restaurant QR Codes?
Most restaurant QR codes are legitimate. Still, check whether the code appears to belong to the restaurant and look at the destination before opening it.
Should I Use a QR Scanner App?
Usually not. Current iPhones and Android phones can scan QR codes using their built-in camera features.
What Should I Do If I Entered My Password on a Fake QR Website?
Go directly to the legitimate service and change your password immediately. If you used the same password elsewhere, change those passwords as well and enable two-factor authentication where available.
Helpful Products
- Check this out on Amazon: RFID-Blocking Travel Wallet
- Check this out on Amazon: Webcam Privacy Covers
- Check this out on Amazon: USB Data Blocker
This article may contain affiliate links. If you purchase through these links, we may earn a commission at no extra cost to you.