The dangerous part of a QR code is the destination you cannot see

A QR code usually encodes a URL or other data. A phone camera can open that destination without the user first seeing the full address, which gives a phisher a chance to hide a misspelled or lookalike domain behind a plausible instruction. The Federal Trade Commission has described QR scams on parking meters and in unexpected texts or emails, including fake package notices and account warnings. The FBI has warned that QR codes in targeted messages can move a victim from a monitored work computer to a personal phone, where corporate email filters may not see the next step.

After scanning, inspect the displayed address before opening it. Look for misspellings, unexpected subdomains, or a shortened URL that conceals its destination. A familiar logo or physical sticker does not authenticate the link: criminals can cover a legitimate parking or payment code with their own. If the page asks for credentials or payment, pause and open the company’s app or type a known address yourself instead of following the code.

Scanning alone does not usually hand over a password; the risk rises when the code leads you to enter information, approve a sign-in, install software or make a payment. A page may copy a real service’s appearance while sending the data to the attacker. A code can also lead to a download or other action. Treat any urgent demand—delivery fee, locked account, missed toll, prize—as a reason to verify through a contact route you already trust.

For businesses, avoid placing QR codes beside sensitive actions without a verifiable destination and a fallback URL. Replace damaged or tampered signage, use short recognizable domains, and train staff to report overlays. For a recipient of an unexpected code, confirm the request with the sender using a separate channel; do not reply to the message that carried the code. If you already entered a password, change it through the official site and review account sessions. The useful safety check happens before you submit data or approve a transaction, not merely when the camera reads the pattern.