A QR code is not dangerous by itself. The risk is where it sends you and what the destination page asks you to do. Learn the quick checks before opening a scanned link.
A QR code is just a way to write information into an image. It can contain a link, text, phone number, WiFi details, or contact. By itself, it is not automatically dangerous.
The risk appears when a QR code opens a harmful page, convinces you to enter a password or payment details, or asks you to install an app. That is why QR codes deserve the same basic caution as links in email: convenient, but not always trustworthy.
What makes QR codes risky
The biggest issue is that you cannot see the full content before scanning. On a poster, parking machine, or email, you only see a square pattern. The destination appears only after you scan it.
Scammers can use this:
- placing their own QR code sticker over a real one,
- sending a QR code in an unexpected email or SMS,
- pretending it is about parcel delivery, payment, or an account problem,
- creating a page that looks like a bank, delivery service, or known company,
- pushing you to act quickly.
The FTC and FBI have warned about QR codes leading to phishing pages or being used in fraudulent packages and messages.
Quick check before opening
After scanning, do not rush. First look at what the phone shows.
Check:
- the domain,
- typos in the address,
- suspicious short URLs,
- unusual domain endings,
- whether the page asks for a password or payment,
- whether the message creates urgency.
If a QR code claims to be from a bank, delivery company, or public institution, but the link looks odd, do not continue. Open the official website manually or use the app you already trust.
When not to scan or open a QR code
Be especially careful in these situations:
- the QR code arrived in an unexpected SMS or email,
- the message says you must act immediately,
- the code is stuck over another code in a public place,
- after scanning, it asks for a password, card number, or account access,
- you do not know the sender,
- the domain does not match the organization it claims to represent.
For parking, payments, and delivery messages, it is safer to use the official app or type the known website address manually.
What if you already opened it?
Opening a link by itself does not always mean there is a problem. The risk increases if you:
- entered login details,
- entered card details,
- installed an app,
- allowed access to files, contacts, or notifications,
- downloaded a suspicious file.
If you entered a password, change it immediately. If you use it elsewhere, change it there too. Turn on two-factor authentication. If you entered payment details, contact your bank.
How to create safer QR codes for your own users
If you use QR codes for customers, think about trust too:
- use your own recognizable domain,
- write the readable URL next to the QR code,
- explain what will happen after scanning,
- avoid suspicious-looking short links unless you need them,
- use official payment solutions for payments,
- regularly check public stickers to make sure nobody covered them.
Are QR codes from a generator safe?
A static QR code created in a generator is just an image with data inside. If you put in your own URL, contact, or WiFi details, the code itself does not change after download.
What matters is what you put into it. If you create a QR code with a trusted URL, users will go there. If someone puts in a scam page, the QR code will be as fraudulent as that link.
Create QR codes only from addresses and details you trust.
Frequently asked questions
Can a QR code install a virus by itself?
Ordinary QR scanning usually only shows a link or action. The danger is opening a scam page, downloading an app, granting permissions, or entering sensitive details.
Is it safe to scan a QR code in a restaurant?
Usually yes, if it is a menu and the link looks trustworthy. Be careful with covered stickers, payments, and pages that ask for extra information.
How can I spot a suspicious QR code?
Common warning signs are unexpected context, urgent wording, unknown domains, typos in the URL, and requests for passwords or payment details.
