Are QR codes safe? The FBI warning, and how to scan without getting caught out
A QR code is only a printed link. What the FBI warned about, what can actually happen when you scan one, and five checks that keep you safe.
Utilica5 min read
The short answer: scanning a QR code is safe. Trusting where it sends you is the part to be careful with.
A QR code is a printed link. Your camera reads the pattern and turns it into text, usually a web address. Nothing happens until you tap that address and decide what to do on the page it opens. The risk is the same as clicking a link in a text from a stranger, with one difference: you cannot read a QR code with your eyes, so you cannot see where it goes before you scan.
What the FBI warning about QR codes says
In January 2022 the FBI's Internet Crime Complaint Center published a warning called Cybercriminals Tampering with QR Codes to Steal Victim Funds. It described criminals:
- Sticking their own codes over real ones, on parking meters, posters and restaurant tables, so a scan goes to a copy of the real site.
- Sending codes in emails and texts that open fake login or payment pages.
- Using those fake pages to collect card numbers, passwords and payments.
In August 2025 the FBI warned about a newer version: packages you never ordered, arriving with a QR code inside and no sender details, so curiosity does the work. The code leads to a page that asks for personal or payment details.
Neither warning says QR codes themselves are dangerous. They say a code is an easy way to hide a bad link.
What happens to your phone when you scan a QR code
- The camera finds the three squares in the corners and reads the pattern between them.
- The phone turns the pattern into text: a web address, a Wi-Fi login, a contact card or plain words.
- It shows you a preview, such as a yellow link button on iPhone or a link card on Android.
- Nothing opens until you tap it.
Scanning on its own does not install anything, read your files or charge you money. Everything that can go wrong happens after the tap, on the page or app the code points to.
What is the real risk of scanning QR codes?
| Risk | What it looks like | How to avoid it |
|---|---|---|
| Fake login page | A page that looks like your bank, Microsoft or a delivery company asks you to sign in | Never sign in from a scanned code. Open the app or type the site yourself |
| Fake payment page | A parking meter or "pay here" sticker opens a page asking for your card | Pay in the official app or at the machine, not through a sticker |
| Unwanted app | The page pushes you to install an app or a "profile" | Only install apps from the App Store or Google Play |
| Too many permissions | A page or app asks for your location, contacts or notifications | Say no unless you know exactly why it needs them |
| Payment app scam | A code fills in someone else's Cash App or Venmo name | Check the name and photo before you pay anyone |
What not to do when scanning a QR code
- Do not scan codes on stickers placed over another code, especially on meters, ticket machines and signs about payments.
- Do not sign in to anything from a page a code opened. If the code says your account has a problem, open your account the usual way.
- Do not install apps or profiles from a scanned link.
- Do not scan codes from packages you did not order or from letters that create urgency, like a final notice or a missed delivery.
- Do not pay a person through a code until you have checked the name the payment app shows.
Five checks before you tap
- Read the address in the preview. Look for misspellings, extra words and odd endings, such as
paypa1-secure.coinstead ofpaypal.com. - Look at the code itself. A sticker on top of a printed code, peeling edges or a code that looks newer than the sign around it are all reasons to stop.
- Ask whether you expected it. A code on a restaurant's own menu is normal. A code in an email from "your bank" is not.
- Notice what the page asks for. A menu, a website or a form for your order is normal. A password, a card number for something you did not plan to buy, or an app install is not.
- When in doubt, go direct. Type the company's address yourself or open its app.
Are short links in QR codes a red flag?
Not by themselves. Most businesses use dynamic QR codes, which hold a short address that redirects to the real page, so they can change the destination without reprinting. That is why many legitimate codes show an address you do not recognize at first.
What matters is where you land. A short address that takes you to the restaurant's own menu is fine. One that lands on a sign-in page is not.
If you run a business: make your codes easy to trust
People are right to be careful, so make it easy for them:
- Put your name next to the code, and say what it does: "Scan for our menu" or "Scan to pay Maria's Tacos".
- Use a code that opens your own page, with your name and logo at the top.
- Check your codes now and then for stickers placed on top.
- Keep payments in apps people know. A code that opens Cash App, Venmo or PayPal shows your name and photo before anyone pays.
Utilica's codes are screened before they redirect, and a scannability check runs before you print. Payment codes open the customer's own app with your name and the exact amount filled in.
Free toolFree QR code generatorMake a QR code right here, free. No account, no trial, no watermark and no scan limit. The code holds your address itself, so nothing can switch it off later.utilica.app/free-qr-codeThe bottom line
QR codes are as safe as the links inside them. Scan freely, read the address, and never type a password or card number into a page you reached through a code you did not expect.
