Is That QR Code Safe to Scan? How to Spot a Fake Before You Tap

You've probably scanned a QR code this month: a restaurant menu, a parking meter, a package label. That little black-and-white square is a shortcut. Point your phone camera at it and your phone opens a web address for you, so you don't have to type anything. The trouble is that scammers know this too.

Here's what's actually true

A QR code is not a virus, and simply pointing your camera at one will not hack your phone. All a QR code does is hold a bit of text, almost always a web address. The danger is where that address takes you. A criminal can print a code that leads to a fake website that looks like your bank, a parking payment page, or a login screen, and then ask you to type in a password or card number. Security folks call this "quishing" (QR code plus phishing, the word for fake messages that trick you into giving up information).

Because a QR code is just a picture, you can't read the address by eye. That is exactly why scammers like them: a suspicious link in an email is easy to spot, but a square of dots looks the same whether it is honest or not.

Where fake codes show up

Local news stations and consumer agencies have reported stickers pasted over the real QR code on parking meters and pay stations, sending drivers to a look-alike payment site. The same trick can appear on restaurant table cards, posters, and flyers. Codes also arrive in emails, texts, and even unexpected packages or letters, often with a scary or exciting message: "Your account is locked," "You missed a delivery," or "Scan to claim your prize."

Five habits that keep you safe

1. Look at the sticker itself. If a code on a meter or sign looks like a sticker placed on top of something else, or the edges are peeling, don't scan it. Use the meter's keypad, a coin slot, or the official app you already have installed.

2. Read the web address your phone shows before you tap. Both iPhone and Android display a small preview of the address when you scan. Check that it matches the business, for example your city's real parking site, and watch for odd spellings, extra words, or strange endings.

3. Be suspicious of urgency. Real companies rarely demand that you scan a code right now to avoid a penalty. Pressure is a scammer's favorite tool.

4. Never scan a code from an unexpected message or package. If your bank, delivery company, or a store seems to be contacting you, close the message and go to their official website or app by typing the name yourself, or call the number printed on your card or statement.

5. Don't enter passwords or payment details on a page you reached by QR code unless you are sure it is genuine. If a page asks you to sign in to something you didn't expect, stop. A password manager is a helpful backstop here, because it will not offer to fill in your saved login on a look-alike site.

What if I already scanned one?

Scanning alone is usually harmless, so don't panic. What matters is what you did afterward. If you only looked at the page and closed it, you're fine. If you typed in a password, change it right away on the real site, and turn on two-factor authentication (a second check, like a code texted to you) if you haven't. If you entered a card number, call your card company using the number on the back of the card, and ask them to watch for or block unfamiliar charges. If you're in the US, you can also report the scam at reportfraud.ftc.gov.

The bottom line

QR codes are not something to fear, just something to treat like any other link. Menus and event tickets from places you trust are fine. The code that deserves a second look is the one that appeared out of nowhere, sits on top of something else, or pushes you to hurry. When in doubt, skip the square and go to the website or app yourself. It takes ten extra seconds and closes the door on this whole kind of scam.