Are QR Codes Safe to Scan? How to Spot a Fake One

Scanning a QR code with your phone's built-in camera is generally safe: the phone just reads some text. The risk is what that text points to. A fake code can open a convincing copy of a bank, parking or delivery site, ask you to install an app, or join you to a Wi-Fi network you don't know. So the rule is simple: read the link preview before you tap, and never pay or log in from a QR code you didn't expect. The FBI, the US Federal Trade Commission and Italy's Polizia Postale all give the same core advice.

What can actually go wrong

Scanning a code with the built-in camera normally just reads text and shows you a preview. A code can contain a web address, Wi-Fi credentials, a contact card, a phone number, a pre-filled text message or plain text. The scams use those normally:

Using a QR code for phishing has a name: quishing. It works because people can't read a QR code by eye, and because it moves the click from a computer (where email filters and a large screen help) to a phone.

How to check a QR code before opening it

On iPhone (iOS 18 and iOS 26)

1. Open Camera, or open Control Center and tap Scan Code (add it from the Control Center gallery if it's missing).
2. Point the phone so the QR code appears on screen. Don't tap yet.
3. Read the link that appears at the bottom of the screen. Look at the domain: the part just before the first single slash, like example.com in https://pay.example.com/zone.
4. Tap only if the domain is exactly the one you expect.

On Android

1. Open the Camera app (Android 9 or later reads QR codes in photo mode on most phones) or Google Lens.
2. Point at the code and wait for the banner. Don't tap yet.
3. Read the link in the banner. If it's cut off, open Google Lens, which usually shows the full text before opening it.
4. Tap only if the domain matches what you expect.

What to look for in the link

• Look-alike domains: a letter swapped or added (examp1e.com, example-parking.com, example.com.pay-zone.info). In the last example, the real domain is pay-zone.info.
• Short links from generic shortening services. They hide the destination. The Polizia Postale advises being wary of shortened URLs and any address that differs from the official domain.
• No https on a page that asks for payment or a password.
• An app download. The FBI advises never installing an app from a QR code: go to the App Store or Google Play and search for it yourself.

Fake codes on parking meters and payment stickers

The most common physical scam is a sticker pasted over a real code on a parking meter, an EV charger, a bike or scooter rental, or a poster. The FTC published a warning about fake codes on parking meters again in September 2026.

1. Look at the code itself. A sticker that's raised, crooked, a different shade, or covering part of the printed design is a warning sign. The FBI specifically tells people to check whether a sticker has been placed over the original.
2. Prefer the official app or website. Type the operator's address yourself, or install their app from the official store. The FBI recommends paying by typing a known URL rather than following a scanned one.
3. Be wary of codes that only offer payment. In Italy, the Polizia Postale has warned about fake car insurance offers paid only by QR code; treat "QR code is the only way to pay" as a red flag.
4. Report it. Tell the operator or the local police so the sticker gets removed.

QR codes in emails, texts and letters

Codes also arrive by email, text, on paper notices on windshields and inside unexpected packages. Common hooks: a failed payment, a delivery fee, a parking fine, a security alert asking you to "verify your account". Urgency is the tell.

• Don't scan codes in messages you didn't expect. The FTC's advice is to contact the company through a phone number or website you know is real.
• Fines and public payments: in Italy, check the amount directly on the official site of the issuing body (the Polizia Postale has warned about fake payment requests using the PagoPA name).
• A code from someone you know? The FBI suggests confirming with them through a number or address you already have.

Wi-Fi QR codes

A Wi-Fi QR code contains the network name, the security type and the password. Scanning one on iPhone or Android shows the network name and asks whether to join.

• At home or in a place you trust, it's a convenient way to share a password; here's how to make a Wi-Fi QR code.
• In public, a code taped to a wall can join you to a network someone else runs. That network can see which sites you visit (though not the content of https pages) and can show you fake login pages. Ask staff for the official network name, and avoid entering passwords or payments on public Wi-Fi you can't verify.

Don't install QR scanner apps

Your phone's camera already reads QR codes. The FBI advises against downloading separate scanner apps, which add risk and often ask for permissions they don't need.

If you already scanned a fake code

1. Close the page. Don't reply or enter anything else.
2. Passwords: change the password you entered, and any account where you reused it. Turn on two-factor authentication. A password strength checker can help you pick a strong one.
3. Card details: call your bank to block the card, and watch your statements.
4. App installed: delete it and check what permissions it had.
5. Report it: in the US at ReportFraud.ftc.gov or ic3.gov; in Italy to the Polizia Postale, also online at commissariatodips.it.

How to keep your phone ready for mistakes

Everyone taps a bad link eventually. Keep the operating system and apps updated, use a passcode and two-factor authentication, and keep the most sensitive files, such as ID scans and medical photos, somewhere that a stolen session or a lost phone doesn't expose them. Our guide to protecting your photos if your phone is stolen covers the basics.

Where sigil. fits

sigil. keeps photos and videos in an encrypted vault on your phone, protected with 256-bit encryption and opened only by a sign you draw on a 5×5 grid. There's no account and no server, so there's no sigil. login page for anyone to fake. If you ever get a message or a QR code asking for your sigil. sign or recovery phrase, it's a scam: nobody at sigil. will ever ask for them, and nobody can recover a vault for you.

To send a photo to someone, see how to share photos privately for the options. Making your own codes? Our free QR code generator creates static codes in your browser; read do QR codes expire to see why that matters.

Bottom line

QR codes are safe to scan and risky to follow blindly. Read the domain in the preview, don't pay or log in from a code you didn't expect, check for stickers on meters and posters, never install apps from a code, and use the official app or a typed address when money is involved.

Sources

• FBI IC3: Cybercriminals Tampering with QR Codes to Steal Victim Funds (I-011822-PSA)
• FTC: Scammers hide harmful links in QR codes to steal your information
• FTC: See a QR code parked somewhere? Don't scan it…yet!
• Polizia Postale: Quishing, il furto di dati tramite QR code
• Polizia Postale: QR code e truffe assicurative
• Polizia Postale: Richieste di pagamento falsamente riconducibili a PagoPA
• Apple Support: Scan a QR code with your iPhone or iPad
• Google: Scan QR codes on Camera from Google