What a QR Code Actually Is
A QR (Quick Response) code is a two-dimensional barcode that encodes data — most commonly a URL, but also plain text, contact details, Wi-Fi credentials, or payment information — in a pattern that a camera and decoding software can read quickly. The code itself has no inherent “intelligence” or safety mechanism; it’s simply a visual encoding of whatever data was put into it.
Why QR Codes Can Be Risky
Because a QR code can encode any URL, a malicious one can silently direct you to a phishing website, a page that prompts a risky app download, or a payment request — all without you being able to read the destination in advance the way you normally could by hovering over a text link. This is precisely why QR codes have become a vector for scams, particularly ones physically placed over legitimate codes (like on a parking meter or restaurant table) or shared in unsolicited messages.
Safety Habits Before Scanning
Most modern phone camera apps show a preview of the destination URL before you actually open it — always read that preview carefully rather than tapping through automatically, checking for the same official-domain red flags covered in this project’s guide on verifying government websites (misspellings, unfamiliar domains, generic top-level domains for something claiming to be official or well-known).
Physical QR Codes: An Extra Layer of Caution
A QR code sticker on a public surface (a poster, a payment terminal, a parking sign) can potentially be a sticker placed over the genuine one by a scammer. If a public QR code looks slightly out of place, oddly placed, or you have any doubt, it’s safer to navigate to the destination independently (typing a known website address, or using an official app) rather than scanning a QR code you can’t be fully sure is genuine.
Generating Your Own QR Codes
When generating a QR code yourself (for a business card, a menu, or sharing a link), double-check exactly what data you encoded before printing or sharing it widely — the same way you’d proofread a printed URL — since a wrongly-encoded QR code sends everyone who scans it to the wrong place, and QR codes printed on physical materials aren’t easy to quietly correct afterward.