QR codes: what they can do, and when not to scan one
A QR code cannot carry a virus. The risk is entirely in where it sends you, which makes the sensible precautions quite specific.
By Hasnain Butt Akhtar, founder and developer ·
A QR code is a picture of some text. That is the whole thing. It cannot install anything, run anything, or do anything by itself, and understanding that makes the real risks much easier to think about.
What is inside one
Those black and white squares encode a short piece of text, usually a few hundred characters at most. Your camera reads the pattern, recovers the text, and then decides what to do with it based on what it looks like.
| What it contains | What your phone does |
|---|---|
| A web address | Offers to open it, which is the overwhelming majority of codes |
| Network name and password | Offers to join that Wi-Fi network |
| Contact details | Offers to save a new contact |
| Plain text | Shows it to you |
| Payment information | Opens a banking or payment app with details filled in |
In every case your phone asks before acting. That confirmation step is your protection, and it is why the advice below is about reading rather than avoiding.
The risk that is actually real
The genuine problem is not the code, it is the destination. And the most common attack is refreshingly low technology: someone prints a sticker with their own code and puts it over the real one.
This has happened widely on parking meters, restaurant tables, electric vehicle chargers and posters. The sticker leads to a convincing copy of the payment page, and people enter card details into it because the context looked entirely normal.
Which gives one physical check worth making a habit. If a code is on a sticker that looks added, run your thumbnail over the edge. A code applied over another one usually has a raised edge, a slightly different finish, or sits at an angle to whatever it is printed on. In a car park or a restaurant, that ten second check is the whole defence.
Reading the address before you tap
Every modern phone shows the address before opening it. Actually looking at it takes a second and catches nearly everything.
What you are checking is the domain, meaning the part immediately before the first single slash. In
https://pay.example-council.co.uk/parking the domain is example-council.co.uk. Everything after
the slash can say anything at all and is chosen by whoever owns that domain.
The common tricks put a familiar name somewhere it does not control the address. Something like
yourbank.secure-login24.com is a site called secure-login24.com, not your bank. Read from the
slash backwards and this becomes obvious.
Shortened links are a genuine problem here, because they hide the destination entirely. Plenty of legitimate organisations use them, which is unfortunate. If a shortened link arrives with a request for money or credentials, treat it as unverifiable rather than assuming the worst or the best.
When to be more careful, and when not to bother
Scan without much thought: a restaurant menu, a museum exhibit, a ticket at an event, a Wi-Fi code from a member of staff. The worst realistic outcome is a page you did not want.
Look at the address first: anything printed outdoors and unattended, anything that arrived by post unsolicited, anything asking you to log in, and anything at all involving payment.
Do not scan: codes in unexpected emails or messages, which exist specifically because security filters read links but not pictures of links. And codes on letters claiming an unpaid fine or a delivery problem, which is currently one of the most common postal scams.
One rule underneath all of it: never enter a password or card details on a page you arrived at by scanning something. If you need to pay or sign in, open the app or type the address you already know. This single habit removes essentially the entire risk, and costs you nothing.
Making codes that keep working
If you are producing codes rather than scanning them, there is one decision that matters more than the rest.
A static code contains your address directly. It works forever, needs no service behind it, and cannot be tracked or changed by anyone. It also cannot be corrected if the address changes, because the code is the address.
A dynamic code points at a redirection service which forwards to your real address. You can change the destination later and see scan statistics. The cost is that your code now depends on that company continuing to exist and to keep your account active. Printed material with dynamic codes on it becomes worthless the day the service closes or a subscription lapses, and this has caught out plenty of businesses.
For anything printed in quantity or meant to last, static is the safer choice. Use a permanent address of your own, and if you need flexibility, point the code at a page on your own site that you can change.
Making one that scans reliably
- Keep the address short. Less text means fewer, larger squares, which scan far more easily from a distance or in poor light.
- Leave the quiet zone. Codes need clear space around them, roughly the width of four squares. Cropping tightly is the most common reason a printed code fails.
- Dark on light, with real contrast. Inverted codes and low contrast colour schemes are unreliable. This is not the place for subtle design.
- Print it large enough. A rough guide is a tenth of the scanning distance, so a code read from two metres wants to be about twenty centimetres across.
- Test it before printing a thousand. On more than one phone, at the distance and in the lighting people will actually use.
A logo in the middle of a code works because of built in error correction, which lets a code survive damage to part of it. Covering more than about a quarter of it will start causing failures that only show up in poor light, so if you are placing artwork over a code, test it somewhere dim before committing to the print run.