# Is scanning QR codes with your phone risky? **URL:** \ **Category:** Factual Questions\ **Created:** [September 17, 2021, 10:00pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846 "2021-09-17T22:00:15Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![LurkMeister](https://avatars.discourse-cdn.com/v4/letter/l/3da27b/32.png) [@LurkMeister](https://boards.straightdope.com/u/LurkMeister)\ **Post date:** [September 29, 2021, 9:17pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/41 "2021-09-29T21:17:18Z")
I understand that the QR code is a website address, but am I supposed to whip my phone out before the QR code disappears from the screen and point the camera at my TV, which will be able to read the QR code from 15 feet away? My local paper has just decided to supplement their print edition with QR codes that will let me listen to podcasts, watch videos, or be directed to further information on their website. If I wanted to do all that, I’d subscribe to just their online edition, and not bother to get the print edition delivered. I guess I’m just an old fart. (and get off my lawn!) ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [September 29, 2021, 9:20pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/42 "2021-09-29T21:20:27Z")
Obviously you already have your phone out, because everyone always does, and obviously you’re just going to pause the TV, because everyone has a TV that can pause live programming. ---
**Author:** ![Darren\_Garrison](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/darren_garrison/32/92_2.png) [@Darren\_Garrison](https://boards.straightdope.com/u/Darren_Garrison)\ **Post date:** [September 30, 2021, 1:16am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/43 "2021-09-30T01:16:31Z")
> [@LurkMeister](#): > > My local paper has just decided to supplement their print edition with QR codes that will let me listen to podcasts, watch videos, or be directed to further information on their website. If I wanted to do all that, I’d subscribe to just their online edition, and not bother to get the print edition delivered. Would you be more likely to use this feature if the reader was shaped like a cat? ---
**Author:** ![LurkMeister](https://avatars.discourse-cdn.com/v4/letter/l/3da27b/32.png) [@LurkMeister](https://boards.straightdope.com/u/LurkMeister)\ **Post date:** [September 30, 2021, 1:24am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/44 "2021-09-30T01:24:40Z")
I have one of those! A CueCat that I use for scanning barcodes for my ReaderWare DVD inventory program. ---
**Author:** ![Monty](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/monty/32/47_2.png) [@Monty](https://boards.straightdope.com/u/Monty)\ **Post date:** [September 30, 2021, 2:04am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/45 "2021-09-30T02:04:05Z")
Whatever gave you that idea? 😁 ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [September 30, 2021, 10:32pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/46 "2021-09-30T22:32:17Z")
[There are privacy concerns over this practice](https://www.aclu.org/news/privacy-technology/diners-beware-that-meal-may-cost-you-your-privacy-and-security/). I don’t worry too much about it - I figure “they” have all my information one way or another, anyway. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/codinghorror/32/4242_2.png) [@codinghorror](https://boards.straightdope.com/u/codinghorror)\ **Post date:** [October 13, 2021, 9:33pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/47 "2021-10-13T21:33:20Z")
> [@DCnDC](#): > > You can mitigate the danger by using a QR scanner from a company like Norton or Kaspersky (both have apps for Android and iOS) which can give you a preview of the content before taking you to whatever destination it’s directing you to, and warn you if that destination is known to be sketchy. Not a perfect solution, but better than nothing. The built in photo app in iOS will automatically process QR codes and I assume it’s the same on Android. There is no real risk in scanning QR codes if you use the built-in photo apps in Android and iOS to scan them. It’s no different than visiting a URL in your browser. (In fact, in the latest versions of iOS and Android, the photo apps will automatically do OCR and offer to copy any text in the images to your clipboard or even search for photos containing those words… it’s pretty cool!) [![](https://i.imgur.com/lPkEf92.jpg) ](https://i.imgur.com/lPkEf92.jpg) ---
**Author:** ![Dr.Strangelove](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dr.strangelove/32/6613_2.png) [@Dr.Strangelove](https://boards.straightdope.com/u/Dr.Strangelove)\ **Post date:** [October 13, 2021, 9:40pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/48 "2021-10-13T21:40:19Z")
> [@codinghorror](#): > > The built in photo app in iOS will automatically process QR codes and I assume it’s the same on Android. Almost–you have to go to the “Google Lens” mode. But it’s just a couple of taps away. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [October 13, 2021, 9:42pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/49 "2021-10-13T21:42:44Z")
QR Codes—so dangerous and ominously scary. Like some sort of cyberpunk nightmare. Now Aztec codes, those are just fine. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/codinghorror/32/4242_2.png) [@codinghorror](https://boards.straightdope.com/u/codinghorror)\ **Post date:** [October 13, 2021, 9:47pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/50 "2021-10-13T21:47:11Z")
In my strong technical opinion the answer to the question in the title is “no”, **assuming you are on a modern device with all the latest software updates**. It could be restated as “is clicking a link dangerous?” and with a nice up to date device in hand, definitely no. Otherwise we’d all be screwed because people _loooove_ clicking random links! If you want to be extra careful you could go to incognito mode before visiting the link. I do that sometimes for links of sketchy provenance. ---
**Author:** ![Ponch8](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ponch8/32/9883_2.png) [@Ponch8](https://boards.straightdope.com/u/Ponch8)\ **Post date:** [October 13, 2021, 9:54pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/51 "2021-10-13T21:54:40Z")
I’m hardly a technophobic old fogey, but I refuse to scan these stupid QR codes at restaurants for the various reasons mentioned upthread. In fact, I’ve disabled the QR reader on my phone. If the restaurant can’t be assed to give me a real menu, I can always go elsewhere. ---
**Author:** ![Dr.Strangelove](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dr.strangelove/32/6613_2.png) [@Dr.Strangelove](https://boards.straightdope.com/u/Dr.Strangelove)\ **Post date:** [October 13, 2021, 10:00pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/52 "2021-10-13T22:00:10Z")
> [@codinghorror](#): > > Otherwise we’d all be screwed because people _loooove_ clicking random links! The Podesta email dump was a result of a phishing attack, and played no small part in the outcome of the 2016 presidential election. So, uh… yes, we are already being screwed by people clicking random links. The lack of effective verification is one of the biggest security holes on the internet. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/codinghorror/32/4242_2.png) [@codinghorror](https://boards.straightdope.com/u/codinghorror)\ **Post date:** [October 13, 2021, 10:03pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/53 "2021-10-13T22:03:17Z")
Eh, I disagree, that was about 2 factor auth which has made leaps and bounds of progress since 2016! > **[There is no longer any such thing as Computer Security](https://blog.codinghorror.com/there-is-no-longer-any-such-thing-as-computer-security/)** > > Remember "cybersecurity"? Mysterious hooded computer guys doing mysterious hooded computer guy .. things! Who knows what kind of naughty digital mischief they might be up to? Unfortunately, we now live in a world where this kind of digital... So I’ll add a caveat. Is clicking a link dangerous? **NO, assuming you are on a modern device with all the latest software updates and have enabled two factor authentication on your important accounts.** For most people important means email, bank, and whatever you use most for social media. Discourse (here) supports 2FA as well. ---
**Author:** ![Dr.Strangelove](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dr.strangelove/32/6613_2.png) [@Dr.Strangelove](https://boards.straightdope.com/u/Dr.Strangelove)\ **Post date:** [October 13, 2021, 10:09pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/54 "2021-10-13T22:09:12Z")
2FA helps, though 2FA via SMS has problems of its own. There’s still no real solution to _how do I know this page really is what I think it is?_ Sophisticated users can look at the URL for clues, maybe detect if the page itself looks suspiciously different from the normal page, look at the certificate, and so on. But these are all imperfect. There’s probably no perfect solution. But that just means that people need to always be on their guard when visiting a page from an unknown source. Of course, the click itself is not too dangerous (with some exceptions); acting on the contents of the page may well be. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/codinghorror/32/4242_2.png) [@codinghorror](https://boards.straightdope.com/u/codinghorror)\ **Post date:** [October 13, 2021, 10:11pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/55 "2021-10-13T22:11:50Z")
Well yeah if the page you visit is asking you to LOG IN that’s a different thing. I would assume people clicking on a simple informational link that leads to an _unexpected login_ would just bail on it. Certainly in the context of the first post, you’re at a restauraunt scanning a QR code to get a menu in the browser… no way you should see “PLEASE LOG IN TO YOUR BANK ACCOUNT” in the browser at that point 😜 ---
**Author:** ![Dr.Strangelove](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dr.strangelove/32/6613_2.png) [@Dr.Strangelove](https://boards.straightdope.com/u/Dr.Strangelove)\ **Post date:** [October 13, 2021, 10:18pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/56 "2021-10-13T22:18:31Z")
_Please log in to your Google account to continue_ appears in so many places that I’m sure some people get inured to it. And I’ve seen restaurants do a lot of stupid crap with regards to their websites. I’ll bet at least a few have uploaded a PDF of their menu to a Google Drive, which might well trigger a login prompt. ---
**Author:** ![cincinnatus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cincinnatus/32/7990_2.png) [@cincinnatus](https://boards.straightdope.com/u/cincinnatus)\ **Post date:** [October 14, 2021, 12:36am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/57 "2021-10-14T00:36:51Z")
> [@codinghorror](#): > > If you want to be extra careful you could go to incognito mode before visiting the link. I do that sometimes for links of sketchy provenance. Can you please explain incognito mode and exactly how it would protect me? ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/codinghorror/32/4242_2.png) [@codinghorror](https://boards.straightdope.com/u/codinghorror)\ **Post date:** [October 14, 2021, 7:59pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/58 "2021-10-14T19:59:53Z")
Outlined here > **[Incognito browser: What it really means](https://www.mozilla.org/en-US/firefox/browsers/incognito-browser/)** > > Firefox calls it private browsing, Chrome calls it incognito mode. Both let you browse the web without saving your browsing history. TL;DR it turns off a number of tracking features including cookies. It’s kind of like a cloth mask for COVID – it’s only helpful in conjunction with other safety tools, not meant to be a complete solution on its own. ---
**Author:** ![Jackmannii](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jackmannii/32/311_2.png) [@Jackmannii](https://boards.straightdope.com/u/Jackmannii)\ **Post date:** [October 14, 2021, 8:11pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/59 "2021-10-14T20:11:21Z")
In general, is giving your credit card number to an app more dangerous than to a website that displays a lock symbol on the credit card entry page? ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [October 15, 2021, 12:48am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/60 "2021-10-15T00:48:08Z")
I’d always consider giving a credit card number to an app dangerous, because an app ought to be using the much more secure payment service system that comes with the OS. And if they can’t get that right, who knows what else they’re getting wrong with their security? [Previous page](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846.md?page=2) [Next page](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846.md?page=4)