Are QR codes safe?

What the risk actually is

Scammers use fake QR codes to send people to phishing pages that ask for passwords or payment details. This is sometimes called "quishing". A common trick is a sticker placed over a genuine code on a poster, parking meter or table.

How to scan safely

Treat a QR code like any link you were handed.

• Look at the address your phone shows before you tap to open it
• Be careful if the site asks you to log in, pay or download something unexpected
• Check that the code has not been stuck over another one
• Do not scan codes from unsolicited mail or messages you do not trust
• Keep your phone and browser up to date

How to make your own codes trustworthy

If you share QR codes with customers, you can reduce the chance of confusion.

• Use a link on your own domain, so people recognise the address
• Add a frame or short text saying what the code does
• Use tamper-resistant printing for public places, and check them regularly
• Avoid third-party shorteners you do not control
• If you use dynamic codes, review where each one points

Static or dynamic: does it change the risk?

A static code shows exactly what it holds, and it cannot be redirected later. A dynamic code goes through a short link, so you rely on the account owner to keep it pointing at the right place. Protect your account with a strong, unique password.

What PurpleQR does

Link fields in PurpleQR accept only http and https web addresses, and reject dangerous ones such as javascript: or data: addresses. Anyone can report a misuse of a PurpleQR code through the Report abuse page.