Are QR Codes Safe? A Plain Guide for Small Businesses and Their Customers

• A QR code is not dangerous in itself; the risk lives entirely in the link it hides until you scan.
• The main scam, quishing, exploits the fact that you cannot read a code’s destination before scanning it.
• The core safe habit is a two-second check: read the previewed address before you open it.
• A business protects customers by checking its own printed codes for tampering and using a recognisable destination.

Ask whether QR codes are safe and you are really asking whether links are safe. A code is just a link wearing a disguise. Most links are harmless and lead exactly where you expect; a few are not. What makes a QR code feel different is that it hides the address until the last moment, and that single property is the whole of the risk and the whole of the fix.

What is the actual danger?

A QR code cannot, by itself, install anything or steal anything. It carries a web address, and scanning it opens that address, the same as tapping a link in a message. The danger is entirely downstream: where the link goes, and what that page asks you to do. Scanning a bad code is like following a signpost to the wrong town. The signpost did no harm; the town might.

The scam built on this has a name now: quishing, or QR-code phishing. It works precisely because a code removes the check a careful person would otherwise make. You can hover over a suspicious link in an email and read the real address before clicking. A code gives you no such chance, because by the time you can read where it leads, you have already arrived. Authorities have warned about it for years.

How do you stay safe as a customer?

You do not need to swear off scanning. You need one small habit, plus a little suspicion of anything unexpected.

1. Read the address before you open it. Most phone cameras preview the link when you scan. Pause, check the domain is the real one, and watch for lookalike spellings.
2. Distrust codes that arrive out of the blue. A code in an unexpected text, email or parcel deserves no trust by default. Urgency is a warning sign, not a reason to hurry.
3. Never enter passwords or card details on a page you reached by scanning, especially a code you did not go looking for.
4. For anything to do with money, go direct. Type the company’s known address or use its official app rather than scanning to pay or to fix an account.
5. Check physical codes for stickers. If a code looks stuck over another, or its edges are peeling, do not scan it. Tell a member of staff.

What should a business do?

If you put codes in front of customers, their safety is partly in your hands, and a few simple practices go a long way. The most common physical attack is a fraudulent sticker placed over a genuine code, on a poster, a parking meter or a payment sign, so the first duty is to check your own codes.

• Inspect your printed codes now and then for stickers placed over them or signs of tampering, especially any that sit in public and unattended.
• Use a destination that obviously belongs to you. A recognisable web address is itself a security feature, because it lets a cautious customer confirm the code is genuine at a glance.
• Tell customers which channels you use. If you never send codes by text, say so, so a fake one is easier to spot.
• Keep control of where your codes point. A code you can re-point is one you can immediately redirect away from a compromised or outdated page.

So, are QR codes safe? As safe as the links behind them, which means safe in almost every ordinary encounter and worth a two-second glance in the rare one that is not. Close the gap between scanning and seeing with a quick look at the address, and the little square goes back to being what it was designed to be: a fast, harmless bridge to somewhere you meant to go.