# Are QR codes safe?

> Scanning a QR code is safe in itself — it decodes text and nothing else. The risk is entirely in what you do next. A code cannot install software, dial, pay or join a network without your confirmation, but it can send you to a convincing fake page.

Source: https://useqr.app/docs/security/are-qr-codes-safe · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## What a QR code physically cannot do

A QR code is a printed pattern representing text. It has no executable content. It cannot:

- Install an app or run code.
- Place a call, send a message or make a payment without your explicit confirmation.
- Access your camera roll, contacts or location.
- Change any setting on your phone.
- Take money from your account. A payment code initiates a payment **from** the scanner,
  and always requires confirmation and a PIN.

Any claim otherwise — including "scan this code to receive money" — is a scam.

## What it can do

Send you somewhere. That is the whole attack surface, and it is enough:

- A **phishing page** that looks like your bank, your employer's login, or a parking
  payment site.
- A **payment request** with the attacker as the payee.
- A **WiFi network** the attacker controls.
- A **calendar or contact record** with misleading details.
- A **deep link** into an app in an unexpected state.

## The two-second habit

Both iOS and Android show the destination URL on a preview banner before opening it. Read it.
Specifically:

1. Is the **domain** the one you expect? Look at the part immediately before the first single
   slash — `bank.example.com.evil.co` is on `evil.co`.
2. Is it a **shortener**? A shortened link hides the destination, which is what an attacker
   wants.
3. Does it ask for **credentials or payment** on a page you arrived at by scanning? Do not
   enter them; navigate to the site yourself instead.

## The physical check

The most common real-world attack is a **sticker over a genuine code** — parking meters,
payment standees, restaurant tables, EV chargers. Run a finger over it: a sticker has an
edge. If it is a payment code, compare the payee name your app shows against the printed
business name.

## Where the risk is highest

- Unexpected codes in **email or post**, especially claiming MFA re-enrolment or a delivery
  problem.
- **Payment codes in public places.**
- Codes in **untrusted physical environments** — flyers under a windscreen wiper, stickers on
  street furniture.

## FAQ

### Can scanning a QR code give my phone a virus?
No. A QR code contains text and has no executable content. Malware would require you to then download and install something, which takes several deliberate actions.

### Can a QR code steal my bank details?
Not directly. It can send you to a convincing fake login page. The defence is to check the domain on the preview banner and never enter credentials on a page you reached by scanning.

### Is it safe to scan a QR code to pay?
Yes, if you verify the payee name your app shows matches the business. A payment code always requires your confirmation and PIN — but the payee can be substituted by pasting a different sticker over the real code.

### Someone says I can receive money by scanning a QR code. Is that real?
No. That is a scam. Payment QR codes initiate payments from the person scanning, never to them.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate