What a code can and cannot do
Decoding a symbol gives your phone a string. That string might be a URL, a Wi-Fi record, a contact card, a phone number, or plain text. Nothing in the format executes. The phone decides what to offer, and you decide whether to accept.
The line between reading and acting
- A scan cannot install an app on its own A code can point at an app store page. Installing still needs your tap and your account.
- A scan cannot take a payment on its own It can open a payment screen. The transfer needs you to confirm it, usually with a face or fingerprint check.
- A scan can join a network without much ceremony Wi-Fi records are designed for one tap. That is the payload type worth the most caution from a stranger's poster.
- A scan can open a page that looks exactly like a real one This is the whole attack. The page, not the square, takes the card number.
How the scams actually run
The dominant pattern is physical. Somebody prints a sticker and puts it over the real code on a parking meter, a charging station, a restaurant table, or a delivery notice. The replacement points at a copy of the real payment page. Nobody broke any cryptography. They covered a piece of paper with another piece of paper.
The second pattern arrives by email or letter: a code in a message about an unpaid toll, a package on hold, or a suspended account. Putting the link inside an image gets it past filters that read text. The urgency is the tell, not the format.
The third is a code that leads to a login page for a service you do use. You arrive from a physical object, so it feels less like a phishing email, which is exactly why it works.
Four checks before you tap
- Read the domain in the preview Most cameras show the decoded link before opening it. Look at the domain itself, not the friendly words beside it. A long link with a familiar brand buried in the middle is not that brand.
- Feel the sticker Run a finger over the code on a meter or a table. A layer of vinyl over printed paper is the single most reliable sign of tampering.
- Type the address for anything that takes money For parking, tolls, or a bill, open the operator's app or type the address you already know. Skip the square entirely.
- Treat a Wi-Fi code like a network you were handed Joining means trusting the operator with your traffic metadata. See how Wi-Fi QR codes work for what the record contains.
Safety when you make one
The question changes direction when you are the one generating a code. Now the risk is that your payload reaches somebody else's server, or that every future scan is logged.
| Question | Upload or dynamic generator | Vaultaire |
|---|---|---|
| Where the payload is processed | Often on the provider's server | In your browser |
| Who can read a Wi-Fi password you encode | Whoever holds the server logs | Nobody, it never leaves the tab |
| Where a scan goes | Through a provider redirect, if dynamic | Straight to the payload you typed |
| Scan tracking | Often included | None, there is nothing to track with |
The Vaultaire generator makes static codes only. It builds the symbol locally, decodes the finished PNG and SVG again with a separate reader, and unlocks the download after the decoded payload matches what you reviewed. That check is what stops a mangled record from reaching a printer. It says nothing about whether the destination you typed is trustworthy, and no generator can answer that.
QR code safety FAQ
Can a QR code give my phone a virus?
Scanning alone does not install anything. A code stores text. The danger starts after the text becomes an action: a link you open, an app page you install from, a network you join, or a payment you approve.
How do QR code scams work?
Usually a sticker placed over a real code on a parking meter, a table, or a package. The replacement sends you to a page that copies the real one and asks for a card number or a login.
How can I check a code before opening it?
Read the domain in your camera's preview banner, not the words around it. Check that the code is printed on the surface rather than stuck over another one. For anything involving payment, type the address you already know.
Are Wi-Fi QR codes safe?
A Wi-Fi code joins the network it names, and the operator sees your traffic metadata like any other network. Scanning one from an unknown poster puts you on somebody else's network, which is the real risk.
Is a QR code generator safe to use?
It depends on where the payload goes. Many upload the content, or issue a dynamic code that routes every scan through a redirect and logs it. A generator that runs in your browser and makes a static code sends nothing anywhere.
Should I use a QR scanner app?
The built-in camera is enough on current phones and shows the link before opening it. Extra scanner apps ask for camera access and often add their own tracking, which trades a small convenience for a real cost.