QR codes are everywhere. You might scan one to view a restaurant menu, pay for parking, open a website, connect to Wi-Fi or find out more about a product.
Most QR codes are perfectly legitimate. But just like a link in an email or text message, a QR code can send you to a website – and that website isn’t necessarily genuine.
Scammers have realised that QR codes can be a useful way of hiding where a link actually leads. This type of scam is sometimes called “quishing”, a combination of QR code and phishing.
That doesn’t mean you should stop using QR codes. It simply means you should give an unexpected QR code the same caution you would give an unexpected link.
What Actually Happens When You Scan a QR Code?
A QR code is essentially a way of storing information in an image that your phone can read.
Often that information is a website address. When you point your phone’s camera at the code, it recognises the address and offers to open it in your browser.
The QR code itself isn’t automatically dangerous. The important question is where it is sending you.
Think of it like somebody handing you a piece of paper with a web address written on it. The piece of paper isn’t the problem – it’s the website you visit afterwards that matters.
How Can a QR Code Be Used in a Scam?
A scammer can create a QR code that points to almost any website they choose. That could be a fake website designed to look like your bank, a parking service, a delivery company, Microsoft, an online shop, a social network or a government service.
The fake website might then ask you to enter a password, card details or other personal information.
Because you can’t read the destination simply by looking at the pattern of squares, the scam link can be less obvious than a suspicious web address printed in an email.
Can Someone Put a Fake QR Code Over a Real One?
Yes, and this is one of the risks worth being aware of in public places.
Imagine a genuine parking sign containing a QR code for paying online. Somebody could potentially place a sticker containing their own QR code over the genuine one.
You scan it, arrive at a website that looks like the parking company’s payment page and enter your card details. The website may look convincing enough that you don’t immediately realise anything is wrong.
That is why we would be more cautious with QR codes found in open public spaces, particularly when scanning them leads to a payment page or asks for personal information.
What Is “Quishing”?
You may have seen the term quishing. It simply means phishing using a QR code.
Instead of an email saying “click this link”, a message might ask you to scan a QR code to view a document, verify an account, listen to a voicemail or confirm a payment.
The QR code then sends you to a fake login page designed to collect your details.
The UK’s National Cyber Security Centre has warned that criminals increasingly use QR codes within phishing emails. One reason is that people have become better at recognising suspicious links, while a QR code hides the web address behind an image.
Why Are QR Codes Useful to Scammers?
You Can’t Easily See the Link
If an email contains an obviously strange website address, you may immediately become suspicious. A QR code just looks like a collection of black and white squares. You don’t know where it goes until your phone reads it.
They Move You onto Your Phone
You might receive a suspicious email on your computer but scan its QR code using your personal phone. This can move you away from some of the protections or warnings that might have been present on the original computer.
They Feel Familiar
We have become used to scanning QR codes for menus, tickets, parking and other everyday tasks. That familiarity can make us scan first and think afterwards.
Are QR Codes in Restaurants Safe?
Generally, there is no reason to panic about every QR code you encounter.
A code printed properly on a restaurant menu that takes you to the restaurant’s normal website is very different from an unexpected QR code in an email demanding that you verify your bank account immediately.
Context matters. If you’re sitting in a restaurant and the staff have told you to scan a code on the menu to order, that makes sense. If you receive an unexpected email containing a QR code claiming your account will be deleted unless you scan it immediately, that deserves considerably more suspicion.
Be Particularly Careful with QR Codes for Payments
If scanning a QR code leads to a page asking for card or banking information, take a moment before entering anything.
- Were you expecting to make this payment?
- Does the website address look correct?
- Does the amount make sense?
- Could you reach the payment service another way?
- Does the physical QR code look as though a sticker has been placed over another one?
For something such as parking, you may be able to use the operator’s official app or type its known website address yourself instead.
Check the Website Before You Continue
Most modern phones show you some information about the link before opening it. Don’t automatically tap it.
Look at the website address carefully. A scammer may use an address that looks similar to the genuine one, perhaps with an extra word, a spelling change or an unfamiliar ending.
Also remember that seeing a padlock or https does not prove that a website is genuine. Scam websites can use secure connections too.
Don’t Assume a Professional-Looking Website Is Genuine
Fake websites can look extremely convincing. A scammer can copy logos, colours and layouts from a genuine organisation. Good spelling and professional design are no longer reliable signs that a website can be trusted.
Instead, concentrate on how you reached the website, its address and what it is asking you to do.
If you’re unsure, leave the page and find the organisation independently using its official website, app, statement or other trusted contact details.
What About QR Codes in Emails?
We would treat an unexpected QR code in an email with particular caution.
Ask why the sender needs you to scan a code rather than simply using the normal service or app. Be especially suspicious if the email creates urgency or asks you to log in, confirm a password, verify your identity or make a payment.
Rather than scanning the code, open the organisation’s normal app or website yourself and check whether there really is an issue with your account.
Can Scanning a QR Code Give My Phone a Virus?
Simply pointing your camera at a QR code does not normally mean your phone has suddenly been infected.
The greater risk is what happens next. The code could lead to a malicious or fraudulent website, and that website might try to persuade you to enter information, download something or install an app.
If a QR code unexpectedly tells you to install software, a security app, a configuration profile or anything else unusual, stop and check what you’re being asked to do.
Do I Need a Special QR Code Scanner App?
Usually, no. Modern iPhones and Android phones can normally scan QR codes using their built-in camera or QR scanning features.
There is generally no need to download a random QR scanner app just to read a code. Using the functionality already built into your phone keeps things simpler.
How to Scan QR Codes More Safely
- Think about where the QR code came from.
- Be cautious with codes in unexpected emails and messages.
- Check the website address before continuing.
- Be particularly careful before entering passwords or payment details.
- Look for stickers placed over QR codes in public locations.
- Don’t install unexpected apps or software after scanning a code.
- If in doubt, find the organisation’s website or app yourself.
- Use your phone’s built-in QR scanner rather than downloading an unnecessary scanner app.
What Should I Do If I’ve Scanned a Suspicious QR Code?
If you scanned a code but didn’t enter any information, download anything or follow further instructions, there may be nothing else you need to do. Close the website.
If you entered a password, change it as soon as possible. If you use the same password elsewhere, those accounts should be changed too.
If you entered card or banking information, contact your bank using its official contact details.
If you downloaded or installed something because the website told you to, seek advice rather than continuing to follow instructions from the suspicious site.
What If I’ve Lost Money?
If you believe money has been taken as part of a scam, contact your bank promptly and report the fraud through the appropriate official reporting service.
The important thing is to act quickly rather than feeling embarrassed or hoping the problem will disappear. Scam websites are deliberately designed to appear convincing, and anyone can be caught out.
Frequently Asked Questions
Are all QR codes dangerous?
No. QR codes are used legitimately every day. The risk comes from where a particular code sends you and what happens afterwards.
Can I tell whether a QR code is fake just by looking at it?
Usually not. The pattern itself doesn’t tell you whether the destination is trustworthy. Consider the context and check the destination shown by your phone.
Should I scan QR codes in emails?
Be cautious, particularly if the email was unexpected or the code is asking you to log in, verify an account or make a payment. It is often safer to visit the organisation’s normal website or app independently.
Can a QR code steal my bank details?
A QR code can direct you to a fake website designed to collect banking or card information. The code itself isn’t reading your bank details; the scam happens when you enter information into the fraudulent site.
Is it safe to scan a QR code for parking?
Many genuine parking services use QR codes, but public QR codes can potentially be covered with fraudulent stickers. Check the sign and destination website, and consider using the parking operator’s official app or website if you’re unsure.
Do I need antivirus to protect me from QR code scams?
Security software can provide useful protection, but it cannot replace checking where a QR code has taken you and being cautious about entering passwords or payment information. Many QR scams rely on persuading the person rather than infecting the device.
Need Help After Scanning Something Suspicious?
If you’ve scanned a QR code, clicked a suspicious link or entered information into a website and you’re worried about what happened, Barwell Computer Repair can help.
We can check your computer or device, help you understand what information may have been exposed and talk you through the sensible next steps in plain English.
And if you’re not sure whether something is genuine, it is always better to stop and check before entering any information.
Computer & Laptop Repairs
