QR Codes — How They Work and How to Stay Safe

A QR code — the black-and-white square you scan with your phone — is nothing more than a 2D barcode. It stores a bit of text, usually a web address, in a pattern a camera can read quickly. When your phone's camera looks at one, it decodes the text and offers to open the web page. QR codes went from obscure to universal during 2020, when restaurants swapped paper menus for codes to reduce shared surfaces, and the habit stuck.

Modern phones (any iPhone in the past 8 years, most Android phones in the past 5) scan QR codes automatically through the regular camera app — you don't need a separate scanner app. Open the camera, point it at the QR code, and a notification pops up asking if you want to open the encoded link.

The scam version is called "quishing" — QR code phishing. Scammers print fake QR codes and place them over real ones on parking meters, gas pumps, bike-share docks, restaurant menus, and public posters. You scan expecting to pay for parking or view a menu; instead the link goes to a fake payment page that captures your credit card, or to a page that quietly installs malware on your phone. In 2023 the FTC and FBI both issued warnings about quishing scams specifically targeting parking meters in cities including Austin, Atlanta, and Portland.

The simple defense is to preview the URL before you follow it. When your phone scans a QR code, it shows you the web address in a notification before opening. Read it. If the QR code is on a parking meter and the URL goes to some unfamiliar domain ("quick-park-pay.xyz") instead of the city's official parking site, do not tap. When paying or logging in after a QR scan, it's worth a second look.