QR Codes and Viruses - What You Need to Know

Are QR Codes Dangerous?

Let's start with an understanding of what a QR code is. "QR code" is an abbreviation for Quick Response code, a type of barcode that's been around since the early 1990s. Similar to barcodes you see on product packaging, QR codes are two-dimensional. They typically take the form of a square containing dots, which can encode a website address, contact information, or other text. You might find a QR code on a website, in an email, on a restaurant menu, in a magazine, or other printed materials.

When scanned with a smartphone, tablet, or a handheld QR code reader, the encoded text is presented to the user. Simply scanning a QR code will not directly infect your mobile device with a virus or malware. There's always a decision to be made once the QR code is decoded. Proceed to the specified web address? Add this entry to your Contacts? Or put down the phone and back away slowly?

Can a QR code itself contain malware? Theoretically, yes, but it wouldn't do much. A QR code can contain only a limited amount of data: 7089 numeric characters or 4296 alphanumeric characters. You can't write much of a program in that space. But a QR code can easily take you to a malicious site. Humans cannot tell one QR code from another, generally speaking. You have no idea where a QR code is going to take you until you scan it. So it pays to be skeptical of all QR codes, while exercising some common sense.

There's an example QR code on this page, which leads to the AskBob home page. You can safely scan that if you want to see how it works. QR codes printed in paper publications, on in-store posters, on coupons from well-known retailers, and similar places are unlikely to be malicious. But never forget the days when shrink-wrapped software packages were infected with malware at the factory by disgruntled workers.

A QR code scanner is typically built into a mobile device. In some cases, opening the camera app and pointing your phone at the QR code is all that's needed. Some phones have a QR code app that you must open to scan the code. As I mentioned above, QR codes can't initiate actions on your device, such as automatically downloading a file, launching an app, sending a text message, or whisking you off to a website.

So QR codes are innocuous, in and of themselves. However, the content or destination that the QR code points to could potentially be malicious. Scanning a QR code...

• ... could be a link to a malicious website designed to exploit vulnerabilities in your web browser or operating system.


• ... can link to a fake login page, a phishing attack designed to trick you into entering your login credentials.


• ... might offer to a link to download a mobile app.


• ... may initiate a payment transaction via Apple Pay, Google Pay, Zelle, or Venmo.


• ... might prompt you to save a new contact in your device's address book.

In each scenario, you have the choice to proceed or not. User confirmation and/or authentication are required before continuing. You should think of QR codes in the same way as any hyperlink which presents itself, and you have to decide if it's safe to proceed.

The FBI has issued warnings about malware delivered via QR codes. The end result could be theft of data from the phone, a malware download, or redirection to a malicious site, which prompts the victim to enter login credentials or financial information. The latter case is just a twist on email phishing scams, but they use a QR code to obscure the link.

The FBI also warns against downloading apps via QR codes, and advises that you download apps from the official app store for your mobile platform, which would be Google Play for Android devices, and the App Store for the iPhone or iPad. They also advise users to be wary of scams that involve an email about a failed payment with a QR code to complete the payment. If you receive such a message, find the company's customer service phone number on their website and call to verify. Avoid making payments through a website linked to a QR code.

To protect yourself from potential threats when using QR codes, scan only from sources you trust. Verify links before proceeding; if it looks sketchy or doesn't appear to be the expected destination, back away. Make sure your operating system, apps, and antivirus software are up to date. Install a QR code reader with extra security. Trend Micro's Safe QR Code Reader, for example, will perform a safety check on URLs you scan, detecting and blocking sites known for scams, malicious and dangerous content.

Another thing you can do to minimize risk is preview the destination URL before possibly heading off into some dark corner of the Web. Most smartphones will show you the website address encoded in the QR code, and ask you to confirm before continuing. That's no guarantee that the destination is safe, so you might want to copy the URL and paste it into a URL safety checker. The Google Safe Browsing page and the Trend Micro Safety Center both allow you to do that.

If you do decide to install an app -- whether from a QR code or app store -- be sure review the permissions requested by the app. Does that rearrange-the-blocks game really need access to your contacts and your camera?

Bottom line, you need to keep in mind that scanning a QR code will not follow a link, or initiate transfers without you first confirming the action. As with any link or online action, caution and mindfullness is required. When you see a QR code, consider the context and the action you are prompted to take. As always, look before you leap. Post your comment or question below.