A QR code is a promise you cannot read. Every other link on the internet shows you where it goes if you hover or long press. A QR code shows you a square of black and white dots, and by the time your phone has decoded it, you are already halfway to the destination.
That gap is the entire attack surface. Scammers do not need to break the technology. They just need you to trust a square.
What a QR Code Actually Contains
Nothing dangerous by itself. A QR code is encoded text: a URL, a WiFi password, contact details, a payment string. Scanning it cannot install software, cannot access your photos, and cannot run code on your phone.
The risk is entirely downstream. The text is almost always a URL, and once your browser opens it, you are subject to every normal web risk:
- A **fake login page** cloned from a real bank, delivery service or workplace portal
- A **payment page** that takes a real card number for a service you will never receive
- A **prompt to install an app** or a configuration profile from outside the App Store
- A **prefilled payment request** in a wallet app for the wrong amount or recipient
So "can a QR code hack my phone" is the wrong question. The right one is "where does this code send me, and what does that page ask for."
Quishing: Phishing With a Square
Security teams call QR-based phishing **quishing**, and it grew fast for a boring technical reason. Email security filters were built to read text and inspect links. A QR code arrives as an image, so for years the filter saw a picture and passed it through while the URL inside went unchecked.
Attackers noticed. The common email patterns now:
| Lure | What it claims | What it wants |
|---|---|---|
| MFA re-enrollment | "Scan to re-register your authenticator" | Microsoft or Google credentials |
| Password expiry | "Your password expires today, scan to reset" | Current password |
| Missed voicemail | "Scan to hear your message" | Login to a cloned portal |
| Invoice or shipping notice | "Scan to view invoice" | Card details |
| HR document | "Scan to sign your benefits form" | Corporate SSO login |
Note the shared logic. Every one of these moves you from a monitored corporate laptop to a personal phone, which typically has weaker filtering and a much smaller address bar. That is deliberate. On a phone screen you can see maybe 20 characters of a URL.
The Physical Version: Sticker Attacks
The offline version is even simpler and requires no technical skill at all. Print a QR code sticker, walk up to a real one, and cover it.
Locations that get hit repeatedly:
- Parking meters and pay stations. Reported in multiple cities. The fake code leads to a convincing payment page and takes real card details for a parking session that never gets registered.
- Restaurant tables. Menu codes sit unattended for hours and nobody audits them.
- EV charging stations and public transport ticket machines.
- Flyers and posters in stations and on campuses, where an entire fake poster costs a few dollars to print.
- Package inserts in unsolicited deliveries, including the brushing scam variant where you receive a parcel you never ordered with a "scan to see who sent this" card inside.
The FBI issued a public warning about tampered payment QR codes back in 2022 and consumer protection agencies have repeated it since. The technique has not changed because it still works.
Seven Red Flags
1. **A sticker on top of a sticker.** Run your fingernail across it. A layered sticker has a lip you can feel. Curling corners and a code that does not match the surrounding print quality are both tells.
2. **A code in an unsolicited email or text.** Legitimate services almost never require you to move to a phone to log in. If your employer's IT team sends one, verify through a separate channel before scanning.
3. **The destination asks for a password immediately.** No legitimate QR code campaign starts with a credential prompt. That is the whole scam in one step.
4. **A shortened or unfamiliar domain.** bit.ly, tinyurl and lookalikes hide the real destination behind another layer.
5. **Lookalike domains.** paypal-secure-billing.com is not PayPal. Read from right to left: the real domain is the last two parts before the first single slash.
6. **Urgency.** "Your account will be suspended in 24 hours." Time pressure exists to stop you from checking.
7. **A request to install a profile or an app from outside the App Store.** On iPhone this should be an immediate stop. Configuration profiles can change DNS settings and route your traffic.
How to Scan Safely
The single most useful habit: **use a scanner that shows you the decoded URL and waits for a tap before opening it.** The iPhone camera's built-in scanner does show a preview banner, but it is small, truncated on long URLs, and easy to tap through by reflex.
The safe sequence:
1. Scan with an app that displays the full decoded text first.
2. Read the domain right to left. Ignore everything before it. secure.login.yourbank.com.attacker.net is attacker.net.
3. If it is a shortener you cannot expand, do not open it.
4. If it resolves to a login page, close it and navigate to the site yourself by typing the address or using your saved bookmark. This one rule defeats nearly every quishing attempt regardless of how good the fake page looks.
5. Never enter card details on a page you reached only through a code on a physical surface. Pay through the official app or the number printed on the machine.
Smart QR is built around that first step. It decodes the code, shows you the full URL, and keeps a scan history so you can look back at exactly what a code contained after the fact. The history matters more than people expect: if a scan does turn out to be a scam, the logged URL is what you hand to your bank or your security team.
What to Do If You Already Scanned
Scanning alone is rarely the damaging step. What you did next is.
- Only opened the page, entered nothing: you are almost certainly fine. Close the tab. Clear the site data if you want to be thorough.
- Entered a password: change it immediately on the real site, and change it anywhere you reused it. Enable two-factor authentication while you are there.
- Entered card details: call your bank now and freeze the card. Do not wait to see whether a charge appears.
- Installed an app or a profile: delete it. On iPhone check Settings, General, VPN and Device Management for anything you do not recognize and remove it.
- At work: report it even if nothing happened. One reported quishing email usually means dozens were delivered.
Are QR Codes Still Worth Using?
Yes. The technology is fine and the convenience is real. What has to change is the reflex. Treat a QR code exactly as you treat a link from an unknown sender: worth checking before opening, never worth typing a password into.
If you are creating codes rather than scanning them, our guide to making a QR code for free covers static versus dynamic codes and why the choice matters for anyone printing them. And for the basics of scanning on iOS, including scanning from a screenshot or a saved photo, see how to scan QR codes on iPhone.
The Bottom Line
QR codes cannot infect your phone. They can send you somewhere designed to take your password or your card number, and they hide the destination until it is nearly too late.
Two habits cover almost all of it. Feel for stickers on public codes, and never log in or pay on a page you reached only by scanning. Type the address yourself instead. It costs ten seconds and removes the entire attack.