Are QR codes safe?
By Prabhneet Singh Narula, founder of RelyQr · Updated
Short answer
QR codes themselves are safe: a code is just a way to share a link or text, and scanning one can't harm your phone on its own. The risk is where it leads. Scammers stick fake codes over real ones on parking meters, menus and posters, or send them by email, to lead people to phishing sites. A few checks keep you safe.
How QR code scams work
QR code phishing, sometimes called quishing, hides a harmful link behind a code people trust. In January 2022 the FBI warned that criminals were tampering with QR codes to send people to sites that steal login and payment details. In December 2023 the US Federal Trade Commission warned about fake codes on parking meters and in emails and texts that look like they come from a delivery company or bank.
- A sticker with a fake code placed over the real one on a parking meter, menu or poster.
- An email or text with a code that says your account or delivery needs attention.
- A code that opens a page copying a real bank or payment site.
How to check a QR code before you open it
- Read the web address your camera shows before you tap it. Does it match the business?
- Look for a sticker on top of another code, or a code that looks out of place.
- Be wary of codes in unexpected emails and texts, especially urgent ones.
- Don't enter passwords or card details on a page you reached from a code you're unsure of. Type the address yourself instead.
- Use your phone's built-in camera rather than unknown scanner apps.
- Pay at parking meters through the operator's official app or the meter itself if a code looks tampered with.
Can a QR code hack your phone?
A QR code can't run anything on its own: it only contains a link or text, and your phone shows it to you first. The harm comes from what you do next, like entering details on a fake page or installing an app from it. Keep your phone's software up to date, and treat a link from a code like a link in an email.
For businesses: keep your printed codes trustworthy
- Put codes on your own domain, so customers see your name in the address. RelyQr offers custom domains on Business.
- Check your printed codes regularly for stickers on top.
- Put codes behind glass or use tamper-evident labels where people pay.
- Tell customers what the code does and where it leads.
RelyQr checks the destination of every RelyQr code against Google Web Risk and its own blocklist, and blocks codes used for phishing, malware or scams. Anyone can report one from the “Report this code” link on RelyQr-hosted pages, or by emailing support@relyqr.com.
Questions people also ask
Is it safe to scan a QR code with my phone?
Scanning is safe: your phone shows what the code holds before opening anything. Check the address it shows, and only enter details on pages you trust.
Can a QR code steal my information?
Not by itself. A fake code can lead to a page that asks for your information, so the risk is in what you type, not the scan.
Are payment QR codes safe?
Yes, when they're genuine: your payment app shows who you're paying before you confirm. Check the name and look for stickers over the real code.
How do I report a fake QR code?
Tell the business or venue it's on. In the US you can also report scams to the FTC at ReportFraud.ftc.gov. For a code made with RelyQr, use “Report this code” on its page or email support@relyqr.com.
Make a QR code that lasts forever
Free static codes with your logo and no watermark. Dynamic codes you can change after printing keep working on every plan.