Skip to content
UseQR
UseQR on GitHub (opens in new tab)

Security & privacy

Are QR codes safe?

Scanning a QR code is safe in itself — it decodes text and nothing else. The risk is entirely in what you do next. A code cannot install software, dial, pay or join a network without your confirmation, but it can send you to a convincing fake page.

What a QR code physically cannot do

A QR code is a printed pattern representing text. It has no executable content. It cannot:

  • Install an app or run code.
  • Place a call, send a message or make a payment without your explicit confirmation.
  • Access your camera roll, contacts or location.
  • Change any setting on your phone.
  • Take money from your account. A payment code initiates a payment from the scanner, and always requires confirmation and a PIN.

Any claim otherwise — including "scan this code to receive money" — is a scam.

What it can do

Send you somewhere. That is the whole attack surface, and it is enough:

  • A phishing page that looks like your bank, your employer's login, or a parking payment site.
  • A payment request with the attacker as the payee.
  • A WiFi network the attacker controls.
  • A calendar or contact record with misleading details.
  • A deep link into an app in an unexpected state.

The two-second habit

Both iOS and Android show the destination URL on a preview banner before opening it. Read it. Specifically:

  1. Is the domain the one you expect? Look at the part immediately before the first single slash — bank.example.com.evil.co is on evil.co.
  2. Is it a shortener? A shortened link hides the destination, which is what an attacker wants.
  3. Does it ask for credentials or payment on a page you arrived at by scanning? Do not enter them; navigate to the site yourself instead.

The physical check

The most common real-world attack is a sticker over a genuine code — parking meters, payment standees, restaurant tables, EV chargers. Run a finger over it: a sticker has an edge. If it is a payment code, compare the payee name your app shows against the printed business name.

Where the risk is highest

  • Unexpected codes in email or post, especially claiming MFA re-enrolment or a delivery problem.
  • Payment codes in public places.
  • Codes in untrusted physical environments — flyers under a windscreen wiper, stickers on street furniture.

FAQ

Can scanning a QR code give my phone a virus?

No. A QR code contains text and has no executable content. Malware would require you to then download and install something, which takes several deliberate actions.

Can a QR code steal my bank details?

Not directly. It can send you to a convincing fake login page. The defence is to check the domain on the preview banner and never enter credentials on a page you reached by scanning.

Is it safe to scan a QR code to pay?

Yes, if you verify the payee name your app shows matches the business. A payment code always requires your confirmation and PIN — but the payee can be substituted by pasting a different sticker over the real code.

Someone says I can receive money by scanning a QR code. Is that real?

No. That is a scam. Payment QR codes initiate payments from the person scanning, never to them.

Related