QR code security: quishing and how to stay safe
Scanning a QR code is safe — it’s only data. The risk is what the code points to. Here’s how QR-based scams (“quishing”) work and how to protect yourself.
The code isn’t the threat — the destination is
A QR code is just an encoded piece of text, usually a link. Scanning it cannot install anything by itself. The danger is that the link might lead to a phishing page, a malicious download, or a fake payment form. Attackers exploit the fact that you can’t read a URL hidden inside a pattern.
What is “quishing”?
Quishing is QR-code phishing: a scam QR code that sends you to a fake login or payment page to steal your details. Common tactics include stickers placed over real codes on parking meters and restaurant tables, fake codes in emails, and posters in public places.
How to scan safely
- Preview the link first. Good scanners — including our private QR scanner — show the decoded URL before you open it. Read it.
- Check for a tampered sticker. If a code looks like a sticker slapped over another, don’t scan it.
- Watch the domain. Misspellings and odd domains are red flags. A bank will not use a random shortener.
- Never enter passwords or payment details on a page you reached only via an unexpected QR code.
- Don’t install apps a QR code prompts you to sideload.
For businesses creating codes
Print your codes clearly, ideally with your logo and brand colours so they’re recognisable and harder to spoof. Check regularly that public codes haven’t been covered with a sticker.
Frequently asked questions
Can scanning a QR code hack my phone?
Simply scanning cannot. A QR code only contains data. Risk arises only if you then open a malicious link or enter sensitive information on the page it leads to.
How do I know a QR code is safe?
Preview the decoded link before opening it, check the domain looks legitimate, and be wary of codes on stickers placed over other codes.
Is QRcodeUniverse’s scanner safe?
Yes. It decodes entirely on your device and shows you the content before you act on it, so nothing is uploaded and you stay in control.
Scan safely with our private, on-device scanner.