Do this
Never scan QR codes: There is no evidence of widespread crime originating from QR-code scanning itself. The true risk is social engineering scams, which is mitigated by existing browser and OS protections, and by being cautious about the information you give any website.
Why it’s outdated
A QR code is just a way to open a web address, like a link in an email or a text. It can’t install anything or take over your phone by itself. Scams that use QR codes are ordinary scam links: they lead to a fake page and hope you type in a password or a card number.
Common questions
Scanning a QR code is no different from clicking a link. A QR code cannot install malware by itself. The main risk is being tricked into entering your information on a fake website or being prompted to install an untrustworthy app. The important thing is to be cautious about the sites you visit and the actions you take after scanning. QR codes are simply a way to open a website location (URL), not an intrinsic danger on their own.
You should always be cautious with any new website you visit and any information you provide, no matter how you arrived there. Whether you reached the site through a QR code, a search result, or a link someone sent you, the same principle applies: examine the page carefully, confirm it’s legitimate, and be careful before entering personal or financial details. QR codes don’t introduce unique risks; they simply point you to a website (URL). The real protection comes from paying attention to where you’ve ended up, not from avoiding QR codes.
Do this instead
Scan away. A password manager won’t fill in your password on a fake page, and multi-factor authentication means a stolen password alone isn’t enough.