Table of Contents
- The Problem: You Scanned Before You Checked
- Common QR Code Security Risks
- How to Spot a Bad QR Code
- Best Practices for Safe Scanning
- Best Practices for QR Code Creators
- QR Code Security for Businesses
- How QREndless Protects Your Data
- Frequently Asked Questions
The Problem: You Scanned Before You Checked
You see a QR code on a parking meter, a restaurant table, or a flyer. You scan it without thinking. Suddenly you're on a fake website that looks exactly like your bank. This is called quishing, and it's one of the fastest-growing cyber threats today.
QR codes are powerful because they're easy. Point your camera, scan, and you're there. But that same ease is exactly what makes them dangerous. With a typed link, you can see where you're going before you click. With a QR code, you can't. The link is hidden behind a grid of black and white squares. You don't know where it leads until you've already scanned it. And by then, it might be too late.
I've seen this up close. A friend scanned a QR code on a parking meter, paid, and got a receipt. Two days later, his bank called about a strange charge. The meter had a sticker over the real code. His payment went to a stranger. That story is why I take QR security seriously — and why this guide exists.
The FBI has warned about QR code risks. The UK's National Cyber Security Centre has issued guidance on quishing. Security researchers have found fake QR codes on parking meters, fake delivery notices, and even pasted over real codes on restaurant tables. This is a real problem, and it's growing as more people use QR codes.
This guide covers the real security risks of QR codes, how to spot bad codes, and what both scanners and creators can do to stay safe. It also explains how QREndless protects your data by design.
Common QR Code Security Risks
Knowing the threats is the first step to protecting yourself. Here are the most common QR code security risks.
Quishing — QR Code Phishing
Quishing (QR code phishing) is the most common QR code attack. It works like email phishing, but instead of a bad link in an email, the victim scans a QR code that leads to a fake website. These fake sites look exactly like the real ones — your bank, your email provider, your company login page. The goal is to steal your password, payment details, or personal data.
What makes quishing so dangerous is that people trust QR codes more than email links. You've been trained to hover over a link before clicking. But you can't hover over a QR code. You scan it, and you're taken to the destination before you've had a chance to check it.
Common quishing tricks include: fake parking payment codes placed over real ones, QR codes in phishing emails that claim to be from your bank, QR codes on fake delivery notices, and QR codes on fake event tickets.
Data Harvesting and Tracking
Not every bad QR code steals your password. Some are designed to collect data about you. When you scan a QR code that opens a web page, the site can collect your IP address, device type, browser, approximate location, and the time you scanned. This data can be used for targeted ads, profiling, or sold to data brokers.
Some QR codes in public places — like stores, restaurants, and transit systems — are designed mainly for tracking. The link includes unique markers that identify the specific QR code and location, letting the business track your movement and behavior. This may be legitimate marketing, but it's worth knowing how much data you're sharing when you scan.
Payment Fraud
Fake payment QR codes are a growing problem, especially in places where QR code payments are common. A merchant displays a QR code for customers to scan and pay. But an attacker has replaced it with their own code that sends payments to a different account. The customer scans, pays, and the money goes to the attacker instead of the merchant.
This kind of fraud is tricky because the payment looks like it worked. The customer doesn't know anything is wrong until the merchant says they never got the money. Always check the merchant name and payment ID on the screen before confirming any QR code payment.
Bad Redirects and Malware
Some QR codes lead to websites that automatically download malware to your device. This is more common on Android devices where app sideloading is possible, but iPhones are not safe from it either. A bad QR code might lead to a page that asks you to download a "required update" or "security patch" — which is actually malware. In some cases, the QR code uses browser bugs to install malware without any user action.
How to Spot a Bad QR Code
You can't read a QR code with your eyes. But there are simple steps you can take to spot a bad one before you become a victim.
Check the link preview before opening. Most modern phones show a preview of the link after scanning but before opening it. If the link looks wrong — misspelled domain names, unusual endings (like .xyz or .tk), raw IP addresses instead of domain names, or domains that copy a real brand with small changes (like "paypa1.com" instead of "paypal.com") — don't open it.
Look for physical tampering. If a QR code looks like a sticker placed over another QR code, or if the printed material looks changed, don't scan it. Attackers often paste their own QR codes on top of real ones on parking meters, restaurant tables, and public signs.
Be suspicious of QR codes in unexpected places. If you get a QR code in an unsolicited email, text message, or physical mail — especially one that creates urgency ("Scan now to avoid account suspension!") — treat it with the same caution you'd give a suspicious link.
Use a decoder instead of your camera. If you want to check a QR code without actually opening the link, use a tool like the QREndless QR code decoder. It shows you the full decoded content — link, text, or any other data — without going to it. You can check the content safely before deciding whether to visit the link.
Check the context. If a QR code on a restaurant table says "Scan to pay" but the restaurant uses a different payment system, something is wrong. Always check that the QR code makes sense in context.
For a deeper look at how QR codes store data and why you can't tell a bad one from a good one by looking, read our guide on How QR Codes Work.
Best Practices for Safe Scanning
Check the link before clicking. Most phones show a preview of the link after scanning. If it looks wrong (misspelled domains, unusual endings, IP addresses), don't open it.
Use a scanner with built-in safety. Some scanner apps check links against known phishing lists before opening them. The QREndless QR code scanner checks links and hides personal information by default.
Be careful with payment QR codes. Always check the merchant name and amount before confirming any payment. If the details don't match what you expect, cancel.
Don't scan random QR codes. If a QR code appears in an unexpected place or looks like it was pasted over another code, be suspicious.
Decode before you scan. Use the QREndless QR code decoder to check the content of a QR code before opening any links. This is especially useful for QR codes you're not sure about.
Keep your device updated. Security patches protect against known browser and OS bugs that bad QR code websites might use.
Avoid third-party scanner apps. Use your phone's built-in camera for scanning. Third-party scanner apps may collect your data or show ads. Some have even been found to be bad themselves.
Best Practices for QR Code Creators
Keep private QR codes private. If your QR code contains private data (passwords, personal information, secret links), share it only through trusted channels and don't post it publicly.
Use HTTPS links. Always link to HTTPS pages to stop man-in-the-middle attacks on the linked content. An HTTP link in a QR code means the data between the website and the scanner is not encrypted.
Use your own domain for QR code links. Avoid link shorteners, which hide the destination and can be changed later. A shortener like bit.ly/abc123 gives the user no idea where they'll end up, and the creator can change the destination at any time. Your own domain builds trust.
Test before you share. Always test your QR codes with multiple devices and scanners before printing or sharing them. Use the QR scanner to check the content, and test with both Android and iOS devices.
Think about physical safety. Anyone who can touch your printed QR code can copy it or replace it. Place QR codes where tampering would be seen, and consider using tamper-evident stickers for high-value uses.
Give context. Always include text near your QR code that tells people what to expect when they scan it. "Scan to view our menu" is better than a bare QR code — it sets expectations and makes it harder for an attacker to swap the code for a different purpose.
QR Code Security for Businesses
If your business uses QR codes — for payments, menus, marketing, or access control — you have a duty to protect your customers. Here's what to do.
Use dynamic QR codes for public-facing uses. Dynamic QR codes point to a redirect link you control. If the destination needs to change, you update the redirect — no need to reprint the QR code. More importantly, if you find a security problem, you can redirect the QR code to a safe page right away.
Check physical QR codes often. If you have QR codes on parking meters, tables, or posters, check them often for tampering. Attackers can paste their own QR codes over yours in seconds.
Use branded, customized QR codes. A branded QR code with your logo and colors is harder to replace convincingly. Customers also learn to recognize your QR codes, making them more likely to notice if something looks different. Use the QREndless QR code customizer to create branded QR codes that are harder to fake.
Add secure payment checks. For payment QR codes, show the merchant name and payment ID clearly next to the QR code. Train staff to help customers check payment details. Consider using the bulk QR code generator to create unique, trackable payment QR codes for each register or location.
Teach your customers. Include a short note near QR codes about what to expect when scanning. "Scan this code to view our menu at menu.yourrestaurant.com" tells customers exactly what they should see, making them more likely to notice if something is wrong.
Choose browser-based tools for creating codes. When creating QR codes that contain sensitive business data (payment details, internal links, access credentials), use tools that don't upload your data to servers. QREndless is 100% browser-based — your data never leaves your device.
For more on how QR codes work and why security matters at the encoding level, see our QR Code Error Correction Explained guide.
How QREndless Protects Your Data
Security isn't an afterthought at QREndless — it's the foundation. Here's how every tool in the suite protects your data.
100% browser-based processing. Your data never leaves your device. All QR code creation, scanning, and decoding happens in your browser using JavaScript — no server uploads, no cloud processing, no API calls that send your data anywhere. When you create a QR code with your payment details, Wi-Fi password, or personal contact information, that data stays on your device. Period.
XSS protection in the Decoder. The QREndless QR code decoder cleans links and escapes HTML to stop script injection from bad QR codes. If you decode a QR code that contains a bad script, the Decoder neutralizes it before showing you the content.
Personal info masking in the Scanner. The QREndless QR code scanner hides personal information (phone numbers, email addresses) in scan results by default. This stops accidental exposure of sensitive data when showing scan results to others or taking screenshots.
Safe link checking. Links decoded from QR codes are checked for suspicious patterns before being shown as clickable links. Known phishing patterns, suspicious endings, and IP-based links are flagged with warnings.
No account needed. We don't collect your email, name, or any personal information. No sign-up means no data to breach. Use the QR generator, bulk QR code generator, or any other tool without making an account.
No data kept. Since all processing happens in your browser and nothing is sent to our servers, there is no data stored, logged, or kept. When you close the tab, your data is gone from our system — because it was never in our system to begin with.
If you want to check these claims for yourself, the Decoder and Scanner tools work fully offline once the page loads — you can disconnect your internet and they'll still work. That's the proof that your data never leaves your device.
Frequently Asked Questions
Can QR codes contain viruses?
QR codes themselves cannot contain viruses — they're just data (usually text or a link). However, a QR code can link to a bad website that downloads malware to your device. The risk is in the destination, not the QR code itself. Always check the link before opening it, and keep your device's operating system and browser updated to protect against known bugs.
What is quishing?
Quishing (QR code phishing) is a trick where an attacker uses a bad QR code to send victims to a fake website. The fake site looks like a real one — a bank, email provider, or payment system — and tricks victims into entering their password or personal information. Quishing is dangerous because people trust QR codes more than suspicious email links, and because you can't see the destination link before scanning.
Is it safe to scan QR codes on parking meters and restaurant tables?
It can be safe, but you should be careful. These are the most common targets for QR code tampering — attackers paste their own QR codes over real ones. Before scanning, check that the QR code doesn't look like a sticker placed over another code. After scanning, check that the link looks real and matches the expected payment system or menu. If anything looks off, don't go ahead.
How can I check a QR code before scanning it?
Use the QREndless QR code decoder to check the content of a QR code safely. Upload a photo of the QR code, and the Decoder will show you the full decoded content — link, text, or any other data — without going to it. You can check the content before deciding whether to visit the link. This is especially useful for QR codes you're not sure about or that are in public places.
Are QR code payments safe?
QR code payments are usually safe when you check the details before confirming. The main risk is payment fraud — a bad QR code that sends your payment to the wrong account. Always check the merchant name and payment ID on the confirmation screen before completing the transaction. If the details don't match what you expect, cancel the payment. For businesses, using branded QR codes from the QR code customizer makes them harder to fake.
Does QREndless store my QR code data?
No. QREndless is 100% browser-based — all QR code creation, scanning, and decoding happens in your browser using JavaScript. No data is uploaded to any server. You can check this by disconnecting your internet after the page loads — the tools will keep working. When you close the tab, your data is gone from our system because it was never sent to our servers in the first place.
