What is a QR code, and is it safe to scan one?

QR stands for Quick Response. A QR code is the square black-and-white pattern you often see on menus, tickets, signs, packaging, parking machines and posters.

Your phone camera can read the pattern and turn it into useful information.

Think of it as a shortcut you point your camera at.

It saves you from typing a long website address or other information manually.

Scanning does not usually mean a website immediately opens without warning. On current iPhones, when Camera recognises a QR code, a link or action appears for you to tap.

Possible actions include opening a website, showing a ticket, opening an app, joining Wi-Fi, adding contact information, or opening a payment page.

Scanning the code and opening what it points to are two separate steps.

That distinction matters for your confidence and your safety.

1. Open the Camera app.
2. Point the camera at the QR code.
3. Keep the code visible in the frame.
4. A link or action appears.
5. Read it before tapping.
6. Tap only if it looks right.

Current iPhones can also use Code Scanner from Control Centre — this is convenient, but not necessary for everyday use.

Usually, yes — if you trust where it came from and check the destination before opening it.

A QR code is simply a way of storing information. The risk comes from what the code points to.

A dishonest QR code might send you to a fake login page, a fake payment page, a scam website, or a site asking for personal information.

The FTC currently warns that scammers can replace legitimate physical QR codes with their own, including on parking-related payment points.

A quick five-point check covers most situations.

Lower concern: official product packaging, a ticket you expected, an established restaurant menu, a known company’s official material.

Higher caution: an unexpected text, an unexpected email, a random flyer, a sticker on a public payment machine, or a message demanding urgent payment.

Even official-looking material is not an automatic guarantee of safety.

Many phones show the destination before you tap. Check for spelling mistakes, strange company names, extra words, or an address that does not match what you expected.

For more on spotting a fake address, see How can I tell if a website is real or fake?

This matters most for physical codes. Before scanning a QR code on a parking meter, payment terminal, sign or public notice, look closely.

If it appears to be a loose sticker, covering another code, badly placed, or tampered with — do not use it.

The FTC specifically advises caution because scammers have covered legitimate parking QR codes with fraudulent ones.

Higher-risk requests include a password, bank login, card details, PIN, one-time security code, urgent payment, or identity details.

A QR code does not make an unusual request more trustworthy.

If a QR code is asking for money, confirm that you expected to pay, the business or organisation is correct, the website or payment page is correct, and the amount makes sense.

For something important such as parking, a bill or an account payment, use the organisation’s official app, website or another known payment method if you are unsure.

Yes.

This is one of the easiest QR-code scams to understand. A scammer can print their own QR code and place it over a legitimate code. The replacement code might send you to a fake payment page.

This has been reported with parking-related QR codes, and the FTC issued fresh guidance about this in September 2026.

Before scanning a public payment QR code: look at the physical code first.

Treat it like a normal link. If an unexpected message says to pay a fine, verify your account, fix a delivery, avoid legal action, claim a refund, or log in immediately — and gives you a QR code — do not scan it simply because the link is hidden inside an image.

The FTC reported QR codes being used in fake traffic-violation messages in 2026 to direct people to fraudulent payment or data-stealing pages.

If the message claims to come from an organisation, find that organisation independently instead.

Simply pointing your camera at a QR code does not normally mean your phone has been hacked.

The bigger risk is usually what happens next — for example, opening a malicious website, entering a password, providing card details, installing something, or approving a suspicious action.

Keeping your phone’s operating system and apps updated also helps protect against known security problems; the FTC recommends this as part of QR-scam protection.

Scanned it but did not open the link: usually, stop there and do not open it.

Opened the site but entered nothing: close it and do not return to the link.

Entered a password: change it using the real, official website or app. If reused elsewhere, change it there too.

Entered bank or card details: contact your bank or card provider using an official, trusted channel.

Installed something or gave remote access: treat that more seriously and use official device or support channels.

For more detail, see I clicked a scam link on my phone. What should I do?

Usually, no.

Modern iPhones can scan QR codes using the built-in Camera app or Code Scanner. There is no need to download a random QR scanning app simply to scan ordinary codes.

Many modern Android phones can also scan QR codes using the built-in camera or system tools, though exact behaviour varies by device.

I treat a QR code exactly like a link.

I’m happy to scan one. But before I open what it gives me, I look at where it wants to take me.

If it is asking for money, a password or personal information, I slow down and check it first. That takes only a few seconds.

— Majdi