QR Codes Explained: Scan Safely and Avoid Scams

A restaurant menu, parking sign or event poster may offer a small square pattern instead of a long web address. Scan it with a phone and you can open a page, view a ticket or join a network. That square is a QR code: a convenient way to transfer information without typing it character by character.

The same convenience can be misused. A code may lead to a fraudulent payment page or a fake sign-in screen, and you cannot tell where it goes just by looking at the pattern. This guide explains how QR codes work, how to scan them and how to check a request before taking action.

What is a QR code?

QR stands for “quick response.” A QR code is a two-dimensional pattern that a camera or scanner can interpret as data. It can contain a website address, plain text or other information that a compatible device understands. Many people encounter codes on signs, receipts, packaging and digital screens.

A QR code does not need the internet merely to exist. The information is encoded in the image. However, if that information is a web address and you choose to open it, your device typically needs a network connection to reach the destination.

Some codes point to a fixed destination; others lead through a service that can redirect visitors. A printed pattern therefore does not guarantee that the eventual page will always be the same. The operator and the destination matter more than the appearance of the squares.

Common uses in everyday life

Businesses may use codes for menus, receipts, product instructions or event registration. A museum might link to an audio guide. A person might share contact details, while a home router may display a code that helps a compatible device join its wireless network.

Some apps also use codes for sign-in, payment or device pairing. These actions can affect accounts or money, so read the prompt carefully. A code is simply a way to provide information to an app; it does not independently prove that the request is authorized or safe.

Features depend on the device and application. A phone may show a preview of a website before opening it, while a specialized app may interpret the same pattern differently. Use the tool intended for the task and avoid installing an unfamiliar scanner when the phone’s built-in camera already supports scanning.

How to scan a code with a phone

1. Open the camera or the device’s built-in code scanner. On many recent phones, the ordinary camera recognizes QR codes, although the setting and behavior vary.
2. Point the camera at the whole code. Hold the phone steady and give the camera a moment to focus. Good lighting helps.
3. Read the preview before opening it. If the phone displays a web address, check whether the destination makes sense for the place and task.
4. Choose whether to continue. If the code or the destination is unexpected, stop and use a known website, app or contact channel instead.
5. Review the next action. A request to sign in, pay, install an app or approve a device deserves a separate check.

If the camera does not recognize the code, check that scanning is enabled in the device’s settings, clean the camera lens and move closer or farther away. A damaged or low-contrast code may not scan. Do not install a random app solely because a page or stranger insists on a particular scanner.

Can you scan a code displayed on your own phone?

Often, yes, but the method depends on the phone and app. Some photo or browser apps can recognize a code in a saved screenshot, while others offer a menu action for an image. You may also open the image on a second device and scan it with your phone.

The same safety rules apply. A code received by email or text can still point to a fraudulent website. Do not treat a code embedded in a message as safer than an ordinary link; it can conceal the destination from a quick glance.

When an important service asks you to scan a sign-in code, start from the service’s official app or website and confirm what the approval will do. Scanning a code generated by an attacker can sometimes authorize an unintended session or account action.

What is QR-code phishing?

QR-code phishing, sometimes called quishing, uses a code to send someone to a deceptive destination. A criminal may send a code in a message, place a sticker over a legitimate code or display one on a convincing-looking notice. The destination can imitate a payment service, delivery company or sign-in page.

The U.S. Postal Inspection Service’s quishing guidance warns about unexpected codes in messages and public places. The FBI’s QR-code scam guidance also describes risks associated with malicious destinations.

The scam is usually in what happens after the scan: the site may ask for credentials, payment details or an app installation. Scanning a code does not automatically mean you must follow every prompt. You can stop at any point and verify the request separately.

Inspect the destination

If your scanner shows a URL preview, read the domain carefully. Does it match the organization you expected? A familiar name embedded in a longer, unrelated domain is not sufficient. Shortened links and complicated addresses can be hard to assess, so use a known app or typed address for sensitive transactions when in doubt.

HTTPS helps protect a connection in transit, but it does not prove that the site operator is honest. A scam site can use HTTPS and a valid certificate. A professional design, logo or familiar color scheme is also easy to copy.

For a parking payment, for example, check the operator’s official app or instructions rather than relying solely on a code that might have been covered with a sticker. If a sign looks altered or the payment page asks for unexpected information, stop and contact the operator using a known number.

Physical codes: look at the surroundings

Consider whether the code belongs where you found it. A printed code integrated into a restaurant’s menu is different from an unexplained sticker on a payment machine. A sticker can be legitimate, but if it appears to cover another code or looks out of place, ask staff or use another route.

Do not assume that a code is safe because it is displayed in a public location. Anyone may be able to attach a sticker to a sign. Equally, do not accuse a business of fraud solely because a code looks different; verify with the operator through a trustworthy channel.

For events, follow the organizer’s official instructions and avoid sharing a ticket code publicly. A ticket code may represent access to an event. Someone who copies it might be able to use it, depending on the ticketing system’s controls.

QR codes in messages and emails

A message may say you must scan a code to verify your account or receive a refund. Treat that request like an unexpected link. Open the service’s official app or type the known address yourself, then check whether there is an actual alert.

Be suspicious of requests for a password, one-time verification code, recovery key or payment immediately after scanning. A legitimate service may require authentication, but start from a trusted route and understand what you are authorizing. Do not give codes to an unsolicited caller who claims to be helping.

At work, follow the organization’s phishing-reporting procedure. A code sent from a colleague’s account can still be suspicious if the account was compromised or the request is unusual. Confirm through a previously known channel before taking a sensitive action.

Payments, logins and permissions

A payment code can be a convenient way to begin a transaction, but always verify the recipient, amount and purpose in the payment app before confirming. A code or payment request from an unknown person should not override your usual checks. Once money is sent, recovery may be difficult.

For login or device pairing, read the screen on the device that is already signed in. Does it say you are approving a new session, connecting a device or changing an account setting? If you did not initiate that action, deny it and review the account’s security settings.

Be cautious if a destination requests camera, location, notification or accessibility permissions unrelated to the task. Deny unnecessary permissions and leave the page. For example, a simple public menu generally does not need broad control of your phone.

What to do if you scanned a suspicious code

If you scanned but did not open the destination, dismiss the preview. If you opened a page but did not enter information or install anything, close it and review your device’s behavior. The appropriate response depends on what occurred; do not assume every scan has infected your phone.

If you entered a password, use a trusted device and the service’s official site or app to change it. Change the password anywhere else it was reused, review account sessions and recovery details, and enable or review multi-factor authentication. If you shared a one-time code or approved an unfamiliar login, follow the provider’s account-compromise process promptly.

If you entered payment details or sent money, contact your bank or payment provider using a trusted number and explain what happened. If you installed an unexpected app or granted powerful permissions, consult the device manufacturer’s security guidance or a qualified support professional. Report the incident through the relevant provider, workplace or local authority.

Can QR codes carry information other than links?

Yes. A code can contain text or structured information that a compatible app interprets, such as contact details or network configuration. Your device should show a prompt or use an appropriate app before carrying out an action, but behavior varies. Read what the device proposes rather than assuming every code is just a web page.

A Wi-Fi sharing code, for example, may contain network details. Only scan and join a network you trust, and verify the network name with its operator. A code that appears to configure your device or authorize a login deserves the same care as a direct request for access.

A QR pattern is not a signature of authenticity. Anyone can generate a code, and the image alone does not identify its creator. Trust comes from the verified source, the destination and the action you choose to approve.

Frequently asked questions

Do I need a separate QR scanner app?

Many phones can scan using the built-in camera or system scanner. Check your device’s official instructions first. If a separate app is necessary, choose a reputable source and review the permissions it requests.

Is every code on a poster dangerous?

No. QR codes are widely used for legitimate purposes. The point is to check the context and destination, particularly before entering credentials, making a payment or installing software.

Can a scam code look normal?

Yes. The pattern does not reveal whether its destination is trustworthy. A legitimate-looking sticker can point to a deceptive page, so verify the operator and the requested action.

What if the link preview is shortened?

A shortened address can hide the final destination. For a sensitive task, use the organization’s known website or official app instead of relying on a link you cannot confidently verify.

The safe-scan habit

Pause before scanning, inspect the destination, and treat any login, payment or permission request as a separate decision. When the code is unexpected or the stakes are high, use a known route to the service. Convenience is useful, but it should not replace verification.

Further reading: U.S. Postal Inspection Service: Quishing; FBI: QR-code scams. Device features and reporting options vary by location and service.