Are QR codes safe? Quishing and how to protect yourself
Updated 4 November 2026
A QR code is a way of delivering information, usually a web address, and most are perfectly harmless. The trouble is that you can’t read one by eye. A scammer can print a code as easily as anyone else, and you won’t know where it goes until your phone tells you.
Using a QR code to trick someone is often called “quishing”, a blend of QR and phishing. The usual goal is the same as any phishing scam: to get you to hand over a password or card details on a fake website.
How the scams usually work
- •Stickers over real codes. A fake code is stuck over a genuine one on a parking machine, poster or menu, leading to a lookalike payment page.
- •Emails with a code to scan. A message claims your password has expired or a parcel is waiting. A code can get past email link filters, and it moves you from a work computer to a personal phone with fewer protections.
- •Letters and leaflets. A printed code can look official, and many people trust paper more than a text message.
- •Pages asking for too much. The page opens normally, then asks you to sign in, pay a small fee or install an app.
Checks worth making before you trust a code
- •Look at the physical code. On a machine or sign, check for a sticker or anything that looks added on. If it is peeling or sits on top of other print, don’t use it.
- •Read the address. Most phone cameras show the web address before opening it. Look at the domain carefully, including the spelling and what comes right before the first single slash.
- •Check again after it opens. Many legitimate codes go through a short link, so the first address may not be the final one. Check the address bar on the page you land on before entering anything.
- •Be suspicious of urgency. Fines, deadlines and account warnings are classic pressure tactics.
- •For payments, use the official route. If you are paying for parking or a bill, go to the company’s own app or type its website address yourself.
- •Don’t install apps from a code unless you meant to. Get them from your phone’s official app store instead.
If you think you’ve been caught out
If you entered a password, change it straight away, along with any other account that uses the same one, and turn on two-step verification if you can. If you entered card or bank details, contact your bank immediately using the number on your card.
In the UK, you can forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726. If the code was on a machine or a sign, tell whoever runs it so they can remove it.
If you put QR codes on your own materials
People are right to be cautious, so make it easy for them to trust you.
- •Say what the code does in words next to it, such as “Scan to see today’s menu”.
- •Send people to your own domain, on a secure https page, so the address they end up on matches your name.
- •Don’t ask for logins or card details straight after a scan unless that is clearly the purpose.
- •Print a web address beside the code as an alternative.
- •Check public codes regularly for tampering, particularly anything on a machine or in an unattended place. Scan tracking can also help, because a code that goes quiet may have been covered.
What Host Dada does, and doesn’t do
A dynamic code can be repointed by its owner, which is useful and also means the short link alone doesn’t tell you the final page. It’s fair to ask how a provider handles that, so here is what we do:
- •Destinations must be ordinary http or https web addresses. Others, such as javascript: and data: links, are refused, and addresses containing embedded credentials or pointing at private networks are rejected too. We check when a destination is saved and again on each redirect.
- •When someone enters an http address, we look for a secure https version and switch to it if one answers. If not, the code’s owner sees a warning.
- •We never show ads or interstitial pages on a redirect.
- •Our terms prohibit phishing, malware and fraud, and we can suspend a code. Anyone can report a suspect code through our abuse form.
What those checks can’t do
These checks look at the form of the address. They don’t tell you that the page behind it is honest, so we don’t promise that any code made with our service is safe, and no provider can really promise that. The checks in this guide still apply to every code you scan, including ours.
Make your own branded QR code in minutes
Editable destination, real analytics, transparent pricing.
Frequently asked questions
- Are QR codes safe to scan?
- Generally, yes. Scanning simply reads the code, and the risk comes from the page it leads to and what you do there. Check the address, and be wary of anything asking for a login, payment or app install.
- What is quishing?
- Quishing is phishing using a QR code. A fake code leads to a website designed to steal passwords, card details or money, often through a sticker over a real code or a code in an email.
- Can scanning a QR code hack my phone?
- Scanning alone is very unlikely to do harm on an up-to-date phone. Most of the danger lies in the fake pages and downloads a code can lead to, so keep your phone updated and check before you act.
- How can I tell if a QR code is fake?
- You often can’t from the pattern. Look for stickers over the original, read the web address carefully, and if in doubt go to the organisation’s website or app directly.
- What should I do if I entered my details on a fake page?
- Change the password straight away, and contact your bank immediately if you gave card or bank details. In the UK, forward suspicious emails to report@phishing.gov.uk and texts to 7726.