What a QR code actually contains
A QR code is a two-dimensional barcode that writes text in black and white squares. It began in Japan in 1994 as a way to track car parts, and today it carries web addresses, Wi-Fi login details, contact cards, pre-filled text messages and phone numbers. The code itself runs nothing. Your phone camera reads the text and asks whether you want to open it, and that is all. So the safety of a QR code comes down to whether the address inside it is safe. What makes it riskier than an ordinary link is that no one can read the contents just by looking at the pattern.
How fake codes are used
QR scams usually target places where people scan without a second thought. A look-alike sticker placed over the real code is almost impossible to tell apart at a glance.
- Payment codes on parking machines and EV chargers
- Ordering codes on restaurant tables
- Flyers or bill-like letters left in mailboxes
- Code images in texts or emails about parcels, fines or refunds
What to check before opening
Most phone cameras show the address on screen instead of opening it straight away. That brief moment is your best chance to check. The part before the first slash, and especially its last two or three segments, is where you are really going. A shop or agency name near the front means nothing if the ending is unfamiliar. Shortened links hide the real destination, so if payment or a login is involved, it is better not to open them. A sticker that is peeling, crooked or layered on top of another is reason enough to be suspicious.
Rules once a page is open
If a page opened from a code asks for a card number or a password, stop. When an official app or website exists, as with parking fees or utility bills, you can open it directly and get the same result without the code. If the page tells you to install an app, do not download it from anywhere other than the official app store. For Wi-Fi codes, check that the network name matches the one you were told before joining. If you have already entered details, contact your card issuer or bank using their official number, and change the password on any other account that shares it.
Making your own: static or dynamic
When you create a code, know whether it is static, holding the address itself, or dynamic, holding a redirect service's address so the destination can be changed later. A static code goes to the same place forever once printed. A dynamic code is convenient, but if the service shuts down or starts charging, every code you have printed stops working, and in the worst case the redirect could fall into someone else's hands. For anything that will stay on display for a long time, a static code pointing to your own domain is the safer choice.
What makes a code easy to read
QR codes have built-in error correction, so they still scan when part of the pattern is dirty or covered. The standard defines four levels that can recover roughly 7, 15, 25 and 30 percent of the data. A higher level is sturdier, but the squares become denser and a small print can actually become harder to read.
- Leave a blank margin about four squares wide around the code
- Keep strong contrast, such as a dark code on a light background
- Shorter addresses mean larger squares and easier scanning
- Before printing, test with several phones from a realistic distance
Responsibility of whoever posts the code
If you put a code up in a shop or at an event, helping people tell whether it is genuine is part of the job. Printing the destination address in plain text next to the code lets visitors compare it with the preview. Check the spot regularly for stickers stuck over yours, and where possible print in a way that is hard to peel off. If you take payments through a code, scan it yourself now and then to confirm the payment screen shows your business name correctly.
A quick checklist
Checking these four things before scanning avoids most traps. When in doubt, not scanning is the choice that costs you least.
- Is there a sticker on top or any sign of peeling?
- Does the end of the previewed address match where you expect to go?
- Does the page rush you towards payment, a password or an app install?
- Could you simply open the official app or website instead?
🌍 Search the web for this
Each button runs this keyword on that search engine