Are QR Codes Safe? How to Check if a QR Code is Safe

QR Codes themselves are safe, but what they link to can be manipulated. A single scan can quietly redirect you to a fake website, trigger a malicious download, or pressure you into sharing sensitive information with a fake reward offer.

This guide explains how QR Code scams work, the most common scam patterns, and how to check if a QR Code is safe.

To check if a QR Code is safe, follow these six steps:

1. Scan, then pause: preview the URL your camera shows before tapping it, and don’t open links from codes you can’t preview.
2. Verify the website’s security: check for HTTPS and a domain name that matches the brand, and treat shortened URLs as a red flag.
3. Be skeptical of urgency: legitimate QR Codes don’t threaten fines, expiring deadlines, or account suspensions to make you scan.
4. Use a scanner with built-in security checks: apps like Trend Micro QR Scanner flag known malicious links before the page loads.
5. Check the code’s physical source: look for stickers pasted over original signage, and confirm unexpected codes (emails, packages) with the sender directly.
6. Never download files or apps through a QR Code: safe QR Codes open web pages; a forced download is the clearest sign of malware.

Each step is covered in detail below.

Are QR Codes safe?

QR Codes are safe to scan, as they are not executable software and cannot install malware or compromise a modern phone by scanning alone. The primary risk lies in the destination: a malicious QR Code may direct users to a phishing site, initiate a harmful download, or display a fraudulent payment page.

Scammers exploit the gap between the QR Code and its destination. While 58% of consumers believe QR Codes are safe to scan (Uniqode, State of QR Codes 2026), confidence does not guarantee safety. The code’s appearance provides no information about its destination. Scanning a malicious QR Code leads to the following risks.

• Redirects customers to a phishing website that mimics a trusted brand.
• Triggers a malicious file download that installs malware, resulting in a data breach.
• Opens a fake login or payment page designed to capture credentials.
• Leads to deceptive offers that steal data or money, potentially resulting in identity theft.

QR Codes are safe, but the destination they link to determines the risk.

Attackers exploit the fact that QR Codes hide URLs from plain sight, making people trust the code and act quickly without verification.

Microsoft reported that QR code phishing campaigns were growing at rates of up to 270% per month during the 2023–2024 surge, showing how quickly attackers have adopted this tactic.

How QR Code scams work (and why scammers use them)

QR Code scams, sometimes called QR Code phishing or quishing, exploit speed, convenience, and misplaced trust to trick customers into unsafe actions.

QR Code scams follow a predictable sequence of actions. Here's how a typical QR Code scam works.

1. Encounter a QR Code placed in a public location, email, or message.
2. Scan the QR Code because it appears routine or urgent.
3. Get redirected to a fake website or prompted to take an action.
4. Enter credentials, payment details, or install a file.
5. Lose data or install malware without obvious warning signs.

Scammers use QR Codes because they increase the success rate of phishing attempts. QR Codes enable scams for the following four reasons.

• QR Codes hide the destination URL until the code is scanned.
• QR Codes appear in familiar use cases such as menus, payments, and check-ins.
• QR Codes bypass traditional phishing filters used for email links.
• QR Codes work across both physical and digital environments.

The above reasons make QR Code scams a direct threat to mobile device security, since most codes are scanned on smartphones with access to personal data, payment apps, and saved credentials.

Because of the growing abuse of QR Codes, organizations such as the Federal Bureau of Investigation (FBI) have issued warnings urging caution when scanning QR Codes from unknown or unexpected sources.”

How does a quishing attack work?

Quishing (QR Code phishing) is an attack in which criminals hide a malicious link inside a QR Code, because a scanner can’t read the URL before opening it. Nearly every quishing attack follows the same four steps:

1. Create: The attacker generates a QR Code linking to a spoofed login page, fake payment portal, or malware download using a free online generator.
2. Distribute: The attacker places the code where scanning seems routine, such as phishing emails posing as MFA requests, stickers on parking meters or restaurant signs, fake invoices, or unsolicited packages.
3. Lure: The message urges the victim to scan immediately, citing reasons such as account “suspension,” an unpaid fine, or an expiring delivery. A sense of urgency is the key indicator.
4. Exploit: The victim is directed to a convincing replica of a legitimate site and enters credentials or payment details, or their device downloads malware without their knowledge.

The QR Code itself is not compromised; it only delivers a hidden link. Therefore, the most important safety habit is to read the URL your camera previews before tapping it.

How QR Codes are exploited: common attack vectors

QR Code security risks arise because the codes are unreadable to humans; their destination cannot be determined by sight alone. Cybercriminals exploit this core vulnerability, increasingly using QR codes instead of traditional phishing links. Malicious codes can be created with the same free tools as legitimate ones, making tampered codes visually indistinguishable.

Most real-world QR Code exploitation risks fall into three attack vectors:

1. Redirecting a payment

Attackers may physically replace legitimate QR codes on parking meters, restaurant tables, or donation boxes, or distribute malicious codes via phishing emails. Scanning these codes will open a cloned payment page that appears identical to the original. Always verify the domain for spelling errors or subtle changes (e.g., “paypa1.com”) before entering payment information.

2. Harvesting personally identifiable information (PII)

Some malicious codes silently install apps or software that collect personally identifiable information, such as logins, card numbers, and contact lists. Regulators have documented financial losses from these attacks; for example, the Australian Competition and Consumer Commission reported more than 28 QR scams, with combined losses exceeding AU$100,000.

3. Tracking device location and data

Malware delivered through fraudulent QR Codes continuously accesses GPS location, contacts, and device data without further user action or awareness after the initial scan.

Understanding these attack vectors is the first step in developing a QR Code cybersecurity strategy.

How to check if a QR Code is safe in six steps

̌To check if a QR Code is legit, preview the link, verify the website’s security, and confirm the source before taking any action. Suspicious QR Codes appear in unexpected emails, tampered public stickers, or pages that request sensitive information immediately. Follow these 6 steps to evaluate whether a QR Code is safe to scan.

1. Scan the QR Code, but pause before opening the link

Scan the QR Code and review the link preview before opening it. Most phone cameras show a link preview before opening the destination. Use that moment to verify the destination URL. Check that the URL looks legitimate and readable, the spelling is correct, and the domain matches the brand, location, or context.

Be cautious of shortened links or random-looking URLs that do not clearly indicate the destination.

2. Verify the website’s security

Verify the website’s security indicators before interacting with the page. If you open the link, check the browser carefully. Look for HTTPS (not just HTTP) or a padlock icon in the address bar. Be cautious if the page immediately asks for logins, OTPs, payment details, or personal information. Legitimate QR Code destinations rarely request sensitive data without context.

For extra protection, especially on public Wi-Fi, use a VPN before opening links from QR Codes to prevent attackers from intercepting your data. A VPN also masks your real IP address, which helps prevent IP spoofing attacks that can redirect your traffic to fraudulent destinations.

3. Be skeptical of urgency or scare tactics

Treat the QR Code as unsafe if the destination uses urgency or scare tactics. Watch out for urgent or alarming messages such as “Your account will be blocked,” “Immediate action required,” or “You’ve won a prize.” These messages are commonly used in phishing attempts to pressure people into acting quickly without verifying the source.

4. Use a QR Code scanner with built-in security checks

Use a QR Code scanner that checks links against known threat databases. Some QR Code scanners warn you if a link is unsafe by checking it against known threat databases. You can also copy the URL without opening it and scan it using tools such as Google Safe Browsing and VirusTotal. These tools can flag links associated with phishing or malware.

5. Check the source of the QR Code

Consider where the QR Code appears and whether it belongs there before scanning. A QR Code on a branded menu inside a restaurant or on an official poster from a known company is far more trustworthy than one stuck to a random lamp post or taped to the back of a street sign.

Look at how the code is displayed. Stickers placed over existing surfaces can indicate tampering. Random QR Codes on public walls, poles, or unsolicited messages carry a higher risk and are best avoided.

6. Avoid downloading files through QR Codes

If scanning a QR Code prompts a file or app download, pause and avoid proceeding immediately. Attackers often use QR Codes to distribute malicious files disguised as updates, documents, or required apps. Downloading these files can install malware or spyware on your device, exposing personal data, login credentials, or financial information.

→ Related: Use a secure QR Code generator to reduce risk for your customers

Building a strategy to mitigate QR Code transaction risk

Individual vigilance covers personal scans, but any business accepting QR Code-based transactions, such as payments, ticketing, and loyalty sign-ups, needs a formal strategy to mitigate the risk at the organizational level. A layered approach works best, since no single control catches every exploit:

• Multi-factor authentication (MFA) on any account or transaction that a QR Code can initiate, so a scanned credential alone isn’t enough to complete a payment or login.
• Mobile threat defense that blocks unauthorized app downloads and known phishing domains before a malicious redirect can execute.
• Risk-based authentication, which steps up verification automatically when a transaction looks unusual (new device, new location, high value).
• Incident management tooling so that a compromised code or reported scam can be traced, disabled, and reported quickly, minimizing the window of exposure.
• Static or dedicated-IP protections (e.g., dedicated IP VPNs or static residential proxies) for backend systems that process QR-initiated transactions, reducing exposure to automated attacks.
• Tamper-evident, branded QR Codes with visible design elements that are harder for attackers to clone convincingly, paired with regular physical audits of codes displayed in-store or in print.
• Enterprise SSO and role-based access on the QR Code generation platform itself, so QR Code creation is as tightly controlled as the transactions the codes initiate. A compromised login shouldn't be enough to publish a malicious code under your brand.

Enterprises that combine these controls address both sides of the equation: the technical attack surface (vulnerabilities, exploits, hacking methods) and the transactional risk that shows up as fraud losses and chargebacks.

QR Code Safety Checker: Do's and Don'ts

What to do if you've scanned a fraudulent QR Code

If you've accidentally scanned a malicious QR Code, acting quickly can limit the damage. Below are five steps you can take to minimize the risk of quishing.

1. Change your passwords for affected accounts and enable two-factor authentication: If you entered any login details after scanning, update those passwords immediately. Enable two-factor authentication (2FA) to add an extra layer of security, making it much harder for attackers to access your accounts even if your credentials were compromised.
2. Contact your bank or card provider to flag potential fraud: If you shared any financial information or made a payment, call your bank or card provider right away. They can freeze suspicious transactions, issue a new card, and monitor your account for unauthorized activity.
3. Run a security scan on your device using trusted antivirus software: Use a reputable antivirus app to scan your device for malware or spyware that may have been installed without your knowledge. Remove any threats detected immediately.
4. Monitor your accounts closely for unusual activity: Keep a close eye on your bank statements, emails, and social accounts over the following days and weeks for anything suspicious.
5. Report the malicious QR Code by filing a complaint with the FTC at reportfraud.ftc.gov or contacting the FBI's Internet Crime Complaint Center at ic3.gov.

What are the most common QR Code scams in 2026?

QR Codes were used in 12% of all phishing attacks in 2025, according to a report from cybersecurity platform KeepNet Labs. Below are a few real-world quishing attack scenarios.

1. Parking meters and public payment receipts with fake QR Codes

Scammers place fraudulent QR Code stickers over legitimate payment codes on parking meters, tricking drivers into entering their card details on a fake payment site.

The victim believes they are paying for parking, but their payment information goes directly to criminals. In some QR Quishing cases, scammers pose as bank officials, cite exact transaction details, and extract additional financial information.

The New York Department of Transportation issued a warning that scammers are posting QR Codes on parking meters that are not legitimate payment links.

2. Unsolicited packaging with malicious QR Codes

The FBI issued a warning in July 2025 about a variation of the brushing scam. Criminals send unsolicited packages containing QR Codes designed to steal personal and financial information or install malicious software. The packages often arrive without sender information, and the QR Code may include a prompt such as "scan to find out who sent this gift."

As Bitdefender reported, some of these packages use Amazon branding to create instant trust, directing victims to fake account verification pages that capture login credentials.

3. Phishing emails and messages with embedded QR Codes

Attackers embed malicious QR Codes directly in phishing emails or PDF attachments, often impersonating trusted services such as Microsoft, HR departments, or government agencies.

Kaspersky, a cybersecurity company, recently reported that detections of phishing emails containing malicious QR Codes surged more than fivefold between August and November 2025. These emails typically ask the recipient to scan a code to verify an account, review a document, or resolve a supposed issue. The malicious URL can bypass traditional email security filters that only scan text-based links because it is hidden inside the QR Code image.

4. Public signage and marketing materials with tampered QR Codes

Criminals print QR Code stickers and place them over legitimate codes on restaurant menus, event posters, public transit signs, and EV charging stations. The fake sticker is designed to blend in with the original signage, making it nearly impossible to spot at a glance.

A recent report by the Bureau of Investigative Journalism notes that nearly a third of all local authorities in the UK had their car parks targeted by quishing scammers. The UK’s national reporting center for fraud and cybercrime, Action Fraud, received nearly 800 reports of QR Code fraud. Victims lost a total of £3.5 million in the 12 months leading up to April 2025 from these frauds.

Each of these scams relies on the same assumption that people will scan first and think later. Recognizing the pattern is the first step to breaking it.

Create safe QR Codes with Uniqode

QR Code safety depends on both how customers scan and how businesses create the code. A QR Code created with a safe QR Code generator directs customers to trusted destinations, protects data, and reduces misuse.

Uniqode is built around that standard, trusted by 50,000+ businesses worldwide, including Hilton, Marriott, Toyota, Amazon, and PepsiCo, to manage more than 204 million QR Code scans securely. Businesses create QR Codes while maintaining control over access, data protection, and brand trust. This control comes from three safeguards:

• Authenticity and trust: Custom-branded domains prevent spoofing and make every QR Code traceable.
• Access control: Single sign-on (SSO) ensures only verified employees can create or edit QR Codes, closing the exact gap attackers exploit when a compromised login is used to publish a rogue code. Role-based permissions further restrict who can push a code live versus who can only view analytics.
• Data protection and compliance: ISO 27001:2022, SOC 2 Type 2, GDPR, and HIPAA certifications back every QR Code Uniqode generates. SOC 2 Type 2 means these controls are audited on an ongoing basis, not verified once and forgotten. GDPR compliance covers EU data residency for scan data, and HIPAA compliance makes the platform safe for healthcare QR use cases, such as patient intake and prescription verification.

This isn't just theory. When Maesa, a beauty and personal care company, needed to shut down QR Code fraud that was cutting into revenue, moving to Uniqode's secure infrastructure helped prevent $10 million in losses. It's one reason Uniqode holds a 4.95/5 rating on G2 from real customers.

For businesses that want their QR Codes to be as trustworthy as the brand behind them, Uniqode is the platform to start with. Learn more about safe QR Code generators from this article.

Create your first safe QR Code with Uniqode.