# Is scanning QR codes with your phone risky? **URL:** \ **Category:** Factual Questions\ **Created:** [September 17, 2021, 10:00pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846 "2021-09-17T22:00:15Z")\ **Posts on this page:** 20\ **Page:** 4
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [October 15, 2021, 12:58am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/61 "2021-10-15T00:58:10Z")
The lock symbol on a website merely means that the site is being accessed via HTTPS, which means your communication with the site is encrypted. So no third party can intercept your communication with the site and extract your credit card number from the stream, like they could with a plain HTTP site. However, it tells you nothing about the trustworthiness of the site itself. They could be saving your CC number to use for nefarious activities later. You had better have other reasons to trust the site other than the fact that it is using HTTPS. ---
**Author:** ![Pleonast](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pleonast/32/1183_2.png) [@Pleonast](https://boards.straightdope.com/u/Pleonast)\ **Post date:** [October 15, 2021, 1:38pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/62 "2021-10-15T13:38:02Z")
> [@markn\_1](#): > > They could be saving your CC number to use for nefarious activities later. You had better have other reasons to trust the site other than the fact that it is using HTTPS. It might not even be nefarious, but merely incompetent. Plenty of sites have been found to have stored credit card numbers with poor to no encryption. ---
**Author:** ![Jackmannii](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jackmannii/32/311_2.png) [@Jackmannii](https://boards.straightdope.com/u/Jackmannii)\ **Post date:** [October 16, 2021, 8:03pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/63 "2021-10-16T20:03:25Z")
The company and its site are legit. I’m not entirely confident about the security of its app. ---
**Author:** ![N9IWP](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/n9iwp/32/3154_2.png) [@N9IWP](https://boards.straightdope.com/u/N9IWP)\ **Post date:** [January 12, 2022, 6:55pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/64 "2022-01-12T18:55:36Z")
Well, it could send you to fake payment site: > **[Scammers put fake QR codes on parking meters to intercept parkers’ payments](https://arstechnica.com/tech-policy/2022/01/scammers-put-fake-qr-codes-on-parking-meters-to-intercept-parkers-payments/)** > > Fraudulent QR codes on parking meters found in Houston, Austin, and San Antonio. Brian ---
**Author:** ![Omar\_Little](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/omar_little/32/269_2.png) [@Omar\_Little](https://boards.straightdope.com/u/Omar_Little)\ **Post date:** [January 12, 2022, 7:04pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/65 "2022-01-12T19:04:44Z")
Restaurants using QR codes for diners to pull up their menus using their smart phones is one of those things that I believe will survive Covid, especially for smaller locally owned restaurants, who may change their menus more often. ---
**Author:** ![snowthx](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/snowthx/32/10660_2.png) [@snowthx](https://boards.straightdope.com/u/snowthx)\ **Post date:** [January 12, 2022, 7:07pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/66 "2022-01-12T19:07:54Z")
Interesting. I guess looking over a restaurant menu is still safe, but anything involving money is iffy. ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [January 12, 2022, 7:17pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/67 "2022-01-12T19:17:48Z")
> [@N9IWP](#): > > Well, it could send you to fake payment site: If only @Mangetout worked for those city governments!! He coulda warned them! > [@Mangetout](#): > > One specific context where I had to sternly warn against using QR codes was on public-facing signs for onstreet parking; I was working in local government, and the parking enforcement department wanted to put QR codes on signs on the street, so people could just scan them and go straight to a web page to pay for their parking. Way too easy for someone to overlabel with an alternative URL for a spoofed page that just takes the money somewhere else. ---
**Author:** ![AlsoNamedBort](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alsonamedbort/32/3213_2.png) [@AlsoNamedBort](https://boards.straightdope.com/u/AlsoNamedBort)\ **Post date:** [January 12, 2022, 7:31pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/68 "2022-01-12T19:31:21Z")
> [@ZipperJJ](#): > > If only @Mangetout worked for those city governments!! He coulda warned them! It looks like the city wasn’t using QR codes or even allowing payment on a website. The scammers just stuck up the codes to go to a website. Basically an updated version of a guy walking around accepting payment for parking. ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [January 12, 2022, 7:34pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/69 "2022-01-12T19:34:18Z")
LOL Love the new name 😃 😃 ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [January 12, 2022, 8:23pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/70 "2022-01-12T20:23:04Z")
> [@Jackmannii](#): > > In general, is giving your credit card number to an app more dangerous than to a website that displays a lock symbol on the credit card entry page? Also depends where on the page the lock symbol appears. Browsers that I’ve seen display the HTTPS lock symbol somewhere in the address bar at the top, or in the status bar at the bottom. But I’ve seen lots of dialog boxes (for logging in or entering credit cards, _e.g._) that have a padlock symbol somewhere in the dialog box. These sites are (typically) legitimate, but putting a lock symbol there proves nothing. Any web designer can put any image anywhere on a dialog box! ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [January 12, 2022, 8:24pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/71 "2022-01-12T20:24:51Z")
My Covid vax certificate has a HUMONGOUS QR code on it. I have no idea what it says, but it sure must be more than a URL! ---
**Author:** ![scudsucker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scudsucker/32/14101_2.png) [@scudsucker](https://boards.straightdope.com/u/scudsucker)\ **Post date:** [January 13, 2022, 5:40am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/72 "2022-01-13T05:40:05Z")
Size doesn’t really count. Complexity of the QR code does. They can hold 3Kb of data. From a layperson perspective 3Kb is several “pages” of unformatted text, inasmuch we can use “pages” to describe digital data. Usually, though, they merely carry a URL, because you can fit a lot more data (and advertising) on a website. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [January 13, 2022, 7:20am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/73 "2022-01-13T07:20:38Z")
Size of a QR code may indicate that the person who made it has increased the error correction level - at the maximum level, up to 30% of a QR code can be obscured, defaced or missing and the whole of the data can still be read and recovered from it. > **[Wounded QR code](https://datagenetics.com/blog/november12013/index.html)** > > How far is it possible to distress a QR code and make it still readable? ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [January 13, 2022, 10:29pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/74 "2022-01-13T22:29:04Z")
And sometimes, they’ll plop some other sort of image in the middle of the QR code. I’m not sure if this is officially supported in the standard, or if they’re just counting on the error correction dealing with it. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [January 14, 2022, 6:02am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/75 "2022-01-14T06:02:15Z")
I’m thinking you could plop a QR code into a Game Of Life field and start it running and see what you get. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [January 14, 2022, 8:31am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/76 "2022-01-14T08:31:03Z")
Interesting idea. It would of course become unscannable on the first generation, because the structural parts controlling position, alignment and timing would be broken. Might be interesting to restrain those parts and see if the rest ever turns back into something scannable. Seems very unlikely to happen. I keep meaning to make a device with a little screen on it that shows the current time, encoded as QR (so changing every second). I just like the idea of making people use a device - their phone - that already contains an accurate clock, to read a clock. ---
**Author:** ![Whack-a-Mole](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/whack-a-mole/32/141_2.png) [@Whack-a-Mole](https://boards.straightdope.com/u/Whack-a-Mole)\ **Post date:** [January 18, 2022, 6:57pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/77 "2022-01-18T18:57:15Z")
> [@Mangetout](#): > > One specific context where I had to sternly warn against using QR codes was on public-facing signs for onstreet parking; I was working in local government, and the parking enforcement department wanted to put QR codes on signs on the street, so people could just scan them and go straight to a web page to pay for their parking. Way too easy for someone to overlabel with an alternative URL for a spoofed page that just takes the money somewhere else. It seems that is really happening: > **[Scammers put fake QR codes on parking meters to intercept parkers’ payments](https://arstechnica.com/tech-policy/2022/01/scammers-put-fake-qr-codes-on-parking-meters-to-intercept-parkers-payments/)** > > Fraudulent QR codes on parking meters found in Houston, Austin, and San Antonio. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [January 18, 2022, 7:18pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/78 "2022-01-18T19:18:43Z")
> [@Senegoid](#): > > I’m thinking you could plop a QR code into a Game Of Life field and start it running and see what you get. Dense, unstructured states like that generally don’t do much interesting-- I’m guessing that within 20 timesteps or so, you’d have a half-dozen gliders thrown off, and be left with maybe the same number of squares and blinkers, maybe one or two hexagons. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [January 19, 2022, 6:52am UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/79 "2022-01-19T06:52:17Z")
> [@Chronos](#): > > Dense, unstructured states like that generally don’t do much interesting-- I’m guessing that within 20 timesteps or so, you’d have a half-dozen gliders thrown off, and be left with maybe the same number of squares and blinkers, maybe one or two hexagons. How boring. My Covid certificate has a HUMONGOUS QR code. It must have my entire life biography in it. I was thinking if I plop that into a Life field and let it run long enough, I might eventually get the entire works of Shakespeare. ---
**Author:** ![Sunspace](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunspace/32/1250_2.png) [@Sunspace](https://boards.straightdope.com/u/Sunspace)\ **Post date:** [January 19, 2022, 6:04pm UTC](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846/80 "2022-01-19T18:04:28Z")
> [@Senegoid](#): > > How boring. My Covid certificate has a HUMONGOUS QR code. It must have my entire life biography in it. I was thinking if I plop that into a Life field and let it run long enough, I might eventually get the entire works of Shakespeare. …in Klingon. [Previous page](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846.md?page=3) [Next page](https://boards.straightdope.com/t/is-scanning-qr-codes-with-your-phone-risky/950846.md?page=5)