How QR codes work and how to use them safely

Updated: Oct 28, 2026

QR codes went from a niche industrial tool to something printed on restaurant tables, parking meters, posters and payment terminals. They are convenient because a camera can read them in a moment, and risky for the same reason: a code is opaque to a human, so you are trusting whoever placed it. Knowing what a QR code actually contains, how a scanner interprets it and where the common scams sit makes it easy to use them without becoming a victim.

Modules, error correction and the finder squares

A QR (Quick Response) code is a two-dimensional barcode developed in 1994 for tracking car parts. It encodes data as a grid of dark and light squares. Three large squares in the corners tell the scanner where the code is and how it is oriented; smaller patterns help correct for tilt and distortion. The remaining modules carry the payload plus error-correction data, so a code can still be read with up to about 30 percent of it damaged or covered, which is why logos can sit in the middle.

The payload is just text. A QR code can hold a few thousand characters: a URL, a Wi-Fi network name and password, a contact card, a calendar event, a payment request or plain words. The scanner decodes the text and then decides what to do with it. If the text starts with https://, most phones offer to open it in the browser; if it is a Wi-Fi string, they offer to join the network. The code itself does nothing; the action comes from the app that reads it.

This has two consequences. First, a QR code cannot infect your phone by being scanned. Second, it can take you anywhere its creator chooses, and that destination is where the danger lives.

Common scams

• Sticker over the original. A fraudster prints a code that leads to a fake payment page and sticks it over the genuine one on a parking meter, charging station or bike-hire stand. Victims pay the attacker and are later fined for not paying the real operator.
• Phishing via post or email. Letters and messages that ask you to “scan to verify your account” bypass email link scanners, because the URL is inside an image rather than in text.
• Fake menus and flyers. Codes on tables or posters that lead to look-alike sites collecting card details for a “deposit”.
• Malicious app downloads. A code that leads to an app installer outside the official store, often disguised as a bank or delivery app.
• Wi-Fi codes to rogue networks. Joining an attacker’s network lets them observe unencrypted traffic and present fake login portals.
• Payment-request reversal. In some payment apps, a code can be a request for you to send money rather than receive it. Scammers pretending to refund you rely on this confusion.

Scanning safely

The critical moment is between decoding and acting. Modern camera apps show the decoded URL before opening it. Read it. Look at the domain: pay.cityparking.example is different from cityparking-pay.example.net. Be suspicious of link shorteners, which hide the destination, and of long strings of random characters. If the code sits on a physical object, check whether it is a sticker laid over another code or printed as part of the original design. When a code leads to a login or payment page, ask whether you could reach the same page by typing the organisation’s known address yourself; that is always safer.

Creating codes responsibly

If you publish QR codes for a business or event, use a domain you own rather than a third-party shortener, so the destination is recognisable and will not break if the shortener shuts down. Print the URL in text next to the code so people can verify or type it. For codes in public places, inspect them periodically for tampering. Avoid encoding sensitive data directly; a code on a poster is readable by anyone with a camera.

Scanning QR codes without getting tricked

• Always read the decoded address before opening it; treat it exactly like a link in an unexpected email.
• Do not enter payment or login details on a page reached through a code in a public place unless the domain is one you recognise.
• Prefer official apps or typed addresses for parking, transport and utilities.
• Never install an app from a QR code that leads outside the official store.
• Disable automatic actions in the scanner so that Wi-Fi joins and downloads require confirmation.
• Report tampered codes to the operator of the meter, terminal or venue.

Frequently asked questions

Can scanning a QR code hack my phone?

Scanning alone cannot. Harm comes from what you do afterwards: visiting a malicious page, installing an app or entering details.

Why do some codes not scan?

Poor contrast, glare, a very small print size, or too much damage for the error correction to recover. Increasing distance slightly often helps the camera focus.

Do QR codes expire?

The code itself never changes. If it points to a URL controlled by a service that later disappears or repurposes the link, the destination changes, which is another reason to prefer codes that point at domains you trust.

A QR code is a link you cannot read without a machine; verify the destination as carefully as you would a link in a message.

In short: QR codes store text, most often a URL, and the scanner decides what to do with it. They cannot harm a device by being scanned, but they can lead to fraudulent pages, rogue networks and fake apps. Reading the decoded address before acting removes most of the risk.