Are QR codes safe to scan?
Why a QR code is just a link you cannot read, where fake ones are being placed in the UK, and the two checks that make scanning safe.
- Difficulty
- beginner
- Time
- 10 min
- Read
- 3 min
Short answer
A QR code is a web address you cannot read before you follow it, which is exactly what makes it useful to criminals. Scan it, then read the address that appears before tapping — and treat any code stuck onto a parking meter, a charging point or a table as suspect until proven otherwise.
The technology is not the problem; the inability to see where it goes is. The common UK cases are stickers placed over genuine codes on parking machines and electric vehicle chargers, and codes in letters and emails that lead to fake payment pages.
Step by step
- Understand what you are actually doing.Scanning shows a web address. Nothing has happened yet. The risk is entirely in what you do next, which is why the address is the whole decision.
- Read the address before you tap.Every modern phone camera shows the destination as a preview. Check the domain — the bit immediately before the first single slash — is the organisation you expect, not a look-alike with extra words.
- Be suspicious of stickers.On parking machines, charging points, restaurant tables and public noticeboards, feel whether the code is printed on the surface or stuck over something. A sticker over a printed code is the classic setup.
- Never pay for parking through a scanned code you have not verified.Use the operator's own app, downloaded from the official store, or the phone number printed on the machine. Councils and operators are consistent about which app they use.
- Treat codes in unsolicited post and email as untrusted.A letter that arrives claiming a refund, a fine or a delivery problem, with a code to scan, is a common route because codes are not filtered the way links are.
- Never enter card details or a password on a page reached only by a code.If a page reached this way asks you to sign in or pay, stop. Open the organisation's app or type its address yourself and do it there.
- Do not install anything a code asks you to install.A legitimate code sends you to a website or to the official app store listing. A prompt to download a file directly is always wrong.
- Report a tampered code.Tell the venue or operator so the sticker gets removed, and report the fake site to the NCSC. Physical codes stay in place for weeks otherwise.
Tips
- In a restaurant, ask for a paper menu if the code looks stuck on. It costs nothing and staff will not mind.
- Shortened links inside a code hide the real destination further. If the preview shows a shortener, that is a reason for more caution, not less.
- For anything you use regularly — parking, charging, transport — install the official app once and stop scanning altogether.
Common mistakes
- Scanning and tapping in one motion — The preview exists precisely so you can check. Tapping straight through skips the only defence there is.
- Assuming a code in a public place is official — Anyone with a printer and a sticker can place one. The physical setting says nothing about where the code goes.
If it doesn't work
Scanned a code and reached a page asking to sign in
Cause: Either legitimate or a phishing page — you cannot tell from the page itself — Fix: Close it. Open the organisation's own app or type the address yourself and sign in there. Nothing is lost by doing it the slow way.
Already entered card details
Cause: The page was convincing — Fix: Call your bank on the number on the card, or 159 where supported, and tell them immediately. Then report to Action Fraud.
The camera will not show a preview
Cause: Scanning through a third-party app that opens links directly — Fix: Use the phone's built-in camera instead, which shows the address before opening it.
Questions people ask
Can scanning a code infect my phone?
Simply scanning does not. The risk is the page you are taken to, and anything you then type or install. Keeping the phone updated closes the rarer cases where a page alone could be dangerous.
Are codes on official letters safe?
Often, but the letter itself may be fake. If it concerns money, a fine or an account, use the organisation's usual website or app rather than the code.