Square black-and-white patterns now appear on menus, posters, packaging, and payment terminals everywhere. A quick point of the camera and you are whisked to a website, a menu, or a payment screen. The QR code has become one of the most familiar bridges between the physical and digital worlds, yet few people know how it works or why scanning the wrong one can be dangerous.
What a QR code is
QR stands for quick response, a name chosen because the code can be read almost instantly. It is a two-dimensional barcode. A traditional barcode stores data in the widths of vertical lines and holds only a small amount of information. A QR code stores data in a grid of squares running both horizontally and vertically, which lets it pack in far more, from a web link to contact details or a short piece of text.
When your camera sees the pattern, software translates the arrangement of dark and light squares back into the original data, then acts on it, usually by offering to open a link.
The clever design inside
A QR code is more thoughtfully engineered than it looks. Several features make it fast and forgiving to read.
- Finder patterns. The three large squares in the corners let a camera locate the code and work out its orientation, so it scans correctly even at an angle or upside down.
- Error correction. The code stores redundant information, so it can still be read even if part of it is smudged, torn, or covered. Depending on the setting, a sizable portion can be damaged and the code will still resolve.
- Quiet zone. The blank margin around the code helps the scanner separate it from surrounding clutter.
This robustness is why companies can place a small logo in the middle of a code without breaking it, and why a slightly wrinkled poster still scans.
The hidden risk
Because a QR code is just an encoded instruction, usually a web address, it can send you anywhere, including somewhere harmful. You cannot read a code with your eyes, so you are trusting whoever created it. Scammers exploit this in a tactic sometimes called quishing, a blend of QR and phishing.
Common tricks include pasting a fake code sticker over a legitimate one on a parking meter or payment terminal, printing malicious codes on flyers, or embedding them in emails that lead to convincing fake login pages designed to steal your details.
How to scan safely
You do not need to avoid QR codes, but a few precautions go a long way.
- Before opening a link, check the preview address your phone shows and make sure it matches the site you expect.
- Be suspicious of codes in unsolicited emails, texts, or letters, especially those creating urgency about payments or accounts.
- On physical terminals, look for signs of a sticker placed over the original, such as a code that peels or sits unevenly.
- Never enter passwords or payment details on a page reached from a code unless you are certain the source is genuine; when in doubt, type the address yourself.
- Keep your phone software updated so its browser can warn you about known malicious sites.
A useful tool, used wisely
QR codes are convenient precisely because they are frictionless, but that same smoothness is what scammers rely on. The habit worth building is a brief pause: glance at the address before you tap through, and treat a code from an unknown source with the same caution you would give a suspicious link in an email.
Used sensibly, QR codes are a genuinely handy way to move from the printed world to the digital one in a single tap. Understanding the simple grid behind them, and the risk of trusting a pattern you cannot read, lets you enjoy the convenience without walking into the traps.