Can scanning a QR code by itself harm my phone?

Scanning generally just opens a web address, and modern phones show you that address before going anywhere. The risk comes from the page you land on and what you type into it, not from the scan itself.

How do I see where a QR code leads before opening it?

Hold the camera over the code and wait. Both iPhone and Android display the web address as a banner or notification first, giving you a chance to read it fully and dismiss it if it looks wrong.

Where do tampered QR codes usually turn up?

Anywhere a code is printed in public and left unattended: parking meters, charging points, restaurant tables, event posters, and parcels that arrive unexpectedly. A sticker over an existing code is the giveaway.

Scam guide

QR Code Scams: When Not To Scan a Square Code

A QR code is a web address you cannot read. That is the whole difficulty: a sticker placed over a real code on a parking meter, a parcel, or a restaurant table looks exactly as official as the one underneath it.

Reviewed September 22, 2026

The short answer

Before entering anything, read the web address your phone shows after scanning, and stop if it does not clearly belong to the organization you expected. Where there is another way to pay or sign in, use that instead.

Common warning signs

The code is on a sticker, and there is another code or a printed edge visible underneath it.
A code arrives on an unexpected parcel, letter, or email and asks you to confirm or track something.
The address that appears after scanning is unrelated, misspelled, or shortened so you cannot see the destination.
The page asks immediately for card details, a password, or a one-time code.
You are told scanning the code is the only way to pay, park, or claim something.

What to do instead

Look at the code itself first. A sticker applied over a printed surface is the single most common sign.
Let the phone show the address and read it fully before opening it. Both iPhone and Android preview it first.
Prefer a route you can verify: the official app, a printed phone number, or a web address you type yourself.
Do not enter card details, passwords, or codes on a page you reached only by scanning something in public.
If you think a code has been tampered with, tell whoever owns the site—the council, the shop, or the restaurant.

If you scanned one and entered details

Scanning alone does very little. What matters is what was typed into the page afterwards.

If card details were entered, contact the bank or card company using the number on the back of the card.
If a password was entered, change it there and anywhere else it was used, and turn on multi-factor authentication.
If a one-time code was entered or shared, contact the organization and tell them the code reached someone else.
Note where the code was—the street, the shop, the parcel—so it can be reported accurately to the FTC.

Open Help Now

Common questions

Can scanning a QR code by itself harm my phone?: Scanning generally just opens a web address, and modern phones show you that address before going anywhere. The risk comes from the page you land on and what you type into it, not from the scan itself.
How do I see where a QR code leads before opening it?: Hold the camera over the code and wait. Both iPhone and Android display the web address as a banner or notification first, giving you a chance to read it fully and dismiss it if it looks wrong.
Where do tampered QR codes usually turn up?: Anywhere a code is printed in public and left unattended: parking meters, charging points, restaurant tables, event posters, and parcels that arrive unexpectedly. A sticker over an existing code is the giveaway.

Practice this safely

Practice checking where a scanned code actually leads before deciding whether to enter anything on the page.

Every story is fictional. There is no timer, no score, and no real message, payment, or account.

Start the four-story practice

Official sources

These links open official U.S. government guidance in a new tab. The destination is shown before you open it.

This page provides general educational information. It cannot determine whether a specific message is genuine, investigate an incident, or promise recovery or reimbursement.