Are QR codes safe to scan?
11 min read
QR codes are safe to scan in the sense that a code can't hack your phone by itself: it's just a line of text, usually a web address, and your phone shows it to you before opening anything. The real risk is where that address leads, so the habit that protects you is simple: read the link before you tap it.
In short
- A code can't install anything on its own. The danger is the fake page or the download it leads to.
- Scams usually rely on stickers pasted over real codes, or on codes in emails and texts you weren't expecting.
- Your camera shows the link before it opens. Check the domain, and don't sign in or pay on a page you reached through a code you don't trust.
- Businesses can make codes people trust: their own design, a frame label that says what the code does, and regular checks for stickers.
- Report a suspicious linqr code to hello@onsonara.com with its short link, and we'll look into it.
Contents
How QR code scams work
QR phishing, sometimes called quishing, works like any other phishing: the goal is to get you onto a page that looks real and have you type a password or a card number. The code is just the delivery method, and it works because nobody can read a pattern of black squares by eye. The common setups:
- Stickers over real codes. The FTC describes scammers pasting their own codes over the real ones on parking meters, so drivers pay on a spoofed site.
- Codes in unexpected emails and texts. A message says a package couldn't be delivered or that there's a problem with your account, and asks you to scan a code to fix it. The FTC lists both tricks.
- Fake login and payment pages. The page asks for a bank login, an email password or card details, often with a countdown or a “last chance” warning.
- App downloads. The page pushes you to install an app. The FBI advises against downloading apps from a QR code and recommends your phone's app store instead.
The FTC also warns that a scammer's code can lead to malware that steals your information before you notice, which is one more reason to look before you tap.
How to check if a QR code is safe before you open it
On an iPhone, and on Android phones such as Pixel, the camera shows the link on screen first and opens it only when you tap, as Apple's and Google's help pages describe. That pause is your chance to check.
Point the camera, but don't tap yet
Open the Camera app and hold the phone so the whole code is on screen. A link appears.
Read the domain
Look at the name right before the first single slash. It should match the business or the city whose sign you're looking at, with no misspellings, swapped letters or extra words.
Don't panic about short links
Plenty of honest codes use a short link from a QR service; a linqr code opens onsonara.com/q/ followed by 7 characters. A short link only means you'll see the real address once the page opens.
Check the address bar after it opens
Before you type anything, look at the address again. If the page wants a password or a payment and the domain isn't one you know, close it.
When in doubt, type the address yourself
The FBI recommends paying through a known, trusted address that you enter manually rather than through a site you reached by a code.
bestqrcodegeneratorwithreplaceablelink.com, with no extra dots or words around it. That's linqr's English site.Red flags
- A sticker on top of another code, or a code that looks pasted on, peeling or crooked.
- A code in an email or text you weren't expecting, especially one that says you must act right now.
- A domain that's misspelled, has extra words or numbers, or has nothing to do with the business.
- A page that asks for a password, a card number or a one-time code when you only expected a menu or a schedule.
- A prompt to install an app or download a file you didn't ask for.
- A code that starts a text message or a phone call when you expected a website.
Typed a password into a page you now doubt? Change it on the real site or app and turn on two-factor authentication. Entered card details? Call your bank using the number on the back of your card.
For businesses: codes people trust
If you put QR codes on tables, windows or flyers, a few habits make them easy for customers to trust and hard for anyone to swap. linqr, a free dynamic QR code generator, gives you the tools for most of them:
- Make the code look like yours. Brand colors, your logo in the middle and a frame label such as “MENU” or “LEAVE A REVIEW” tell people what to expect, and a plain sticker pasted on top stands out. See what a custom QR code generator can do.
- Say where it goes. Print the destination in words next to the code, for example “Opens joescafe.com/menu”.
- Put it where tampering shows. Inside the window, on the menu itself or under the table's laminate rather than on a post outside.
- Check your codes. Once a week, scan each placement and look for stickers on top. It takes a minute.
If a sticker has been pasted over your code, remove it and warn customers at the counter. If something is wrong with the destination, such as a hacked page or a shared file someone replaced, pause the code in My codes with Pause: anyone who scans it sees a page saying the code is temporarily disabled until you Resume it. Or point it to a safe page without reprinting; here's how to change a QR code link after printing.
How linqr handles abuse
A linqr code redirects straight to its owner's link, with no ads and no page in between, so we don't show warnings on the way. Here's what we do instead:
- Our terms forbid phishing, malware, illegal content and deceptive redirects, including swapping the link behind a printed code to defraud people.
- Anyone can report a code: email hello@onsonara.com with the short link and what's wrong. The linqr contact page has the details.
- When we block a code, it stops redirecting and shows a page saying the code is no longer active.
- Scanning a linqr code doesn't record your IP address or full browser details.
When a code won't open at all
A code that won't scan is usually a print or design problem, not an attack: it's too small, the contrast is too low, the logo is too big, or glare on a glossy surface hides it. The QR code not working guide walks through the fixes.
If a linqr code opens a page saying it's temporarily disabled or no longer active, the owner paused or deleted it, or we blocked it. Nothing is wrong with your phone.
Make a code your customers can trust
Your logo, your colors and a frame label that says where the code goes. The live scan check tells you whether it scans before you print.
Make your QR codeQuestions
Can a QR code hack your phone?
Not by itself. A QR code is just text, most often a web address, and your phone's camera shows that link and waits for you to tap it. The risk starts after you tap: a fake page can ask for passwords or card details, or push a download. Keep your phone's system updated, read the link first, and don't sign in or pay on a page you reached through a code you don't trust.
Can a QR code give you a virus?
Scanning alone doesn't install anything. The FTC warns that a scammer's code can lead to malware that steals your information, which usually means the page gets you to download an app or a file. Install apps only from your phone's app store, as the FBI advises, and close any page that pushes a download you didn't ask for.
How do I check a QR code before opening it?
Point your camera at the code and read the link that appears before you tap. Check the domain for misspellings or extra words, and ask whether it matches the business. A short link from a QR service is normal; just look at the address bar again once the page opens. In public places, also check that the code isn't a sticker on top of another code.
What should I do if I scanned a suspicious code?
If you didn't enter anything, close the page. If you typed a password, change it on the real site and turn on two-factor authentication. If you entered card details, call your bank. If you installed something, remove it. You can report scams to the FTC at ReportFraud.ftc.gov, and a suspicious linqr code to hello@onsonara.com.
Is it safe to pay at a parking meter with a QR code?
Be careful. The FTC describes scammers pasting their own codes over the real ones on parking meters so drivers pay on a fake site. Check the code for a sticker on top, read the domain before you tap, and when in doubt pay through the city's official app or a website address you type yourself, as the FBI recommends.
Is it safe to scan a QR code in an email or a text message?
Not if you weren't expecting it. Messages about a failed delivery or an account problem that ask you to scan a code are a common phishing trick, according to the FTC. Don't scan it; open the company's app or type its website address yourself. A code in an email you asked for, like a ticket, is a different story.
Why does a QR code show a short link instead of the company's website?
Because it's a dynamic code, which is normal for menus, flyers and business cards. The short link belongs to the QR service and forwards you to the real page, which lets the owner change the destination and count scans. A linqr code shows onsonara.com/q/ plus 7 characters. Check the address bar once the page opens.
Can someone change where a printed QR code goes?
The owner of a dynamic code can, since that's the point of it, but a stranger can't without access to the owner's account. What strangers do instead is paste a sticker with their own code on top. linqr's terms forbid swapping the link behind a printed code to defraud people, and we can block a code reported for it.
Can a linqr code start a download, a call or a text message by itself?
No. A linqr code can only open a web address (http or https), so it can't dial a number, write a text or install anything on its own. The page it opens is chosen by the code's owner, so the usual rule applies there: read the address and don't download apps or files you didn't ask for.
Does scanning a QR code share my location or personal data?
Scanning sends an ordinary web request, like clicking a link, not your GPS position or contacts. When you scan a linqr code, we don't store your IP address or full browser details; we keep the time, approximate location from the network, device type, system, browser and language for anonymous stats. The site you land on has its own privacy rules.
How can a restaurant stop fake QR code stickers on its tables?
Make the real code hard to copy and easy to recognize: your colors and logo, a frame label like “MENU”, and the destination printed in words next to it. Place codes under the laminate or on the menu itself, and check each table once a week for stickers. If you find one, remove it and tell customers at the counter.