A malicious QR code is an image that encodes a link or other content used to trick someone into revealing information, sending money, downloading harmful software, or granting access. The code itself is only a carrier: scanning one does not automatically infect a phone. The risk depends on where it leads and what you do next.
What makes a QR code malicious?
A QR code becomes malicious when its encoded content or destination is used for harmful activity. The most common QR-code version of phishing is called quishing: an attacker hides a deceptive URL in the code and tries to move you to a fraudulent website. That page might imitate a legitimate sign-in, payment, or service page.
As an Amazon Associate I earn from qualifying purchases.
The FBI defines quishing in a January 8, 2026 advisory as a phishing technique that embeds malicious URLs in QR codes to move targets from corporate computers to mobile devices, where traditional email security controls may not apply. The advisory describes campaigns using redirectors and credential-harvesting pages that imitate services such as Microsoft 365, Okta, or VPN portals. Those are reported tactics, not steps that every scam uses. Read the FBI advisory.
What can happen after you scan one?
A scan usually opens or offers to open the encoded destination. The harmful action typically depends on what happens there: entering a password, sharing financial details, paying a fraudulent recipient, downloading an app, or approving an unexpected permission request. The FBI has warned about QR-code scams that seek personal or financial information, redirect payments, or prompt downloads of software intended to steal data. See the FBI warning on unsolicited packages with QR codes.
#1 Best Overall
- Continuous Usage All Day: The EY-H2 USB barcode scanner is designed to always be ready for the next scan, which significantly reduces downtime and repair costs; it shortens checkout lines, improves customer service, and boosts business productivity
- Plug and Play: Eyoyo wired barcode scanner is connected via a USB cable, with no need to install any driver or software; It offers effortless connection and is compatible with Windows, Mac, Android, and Linux; Seamlessly works with Quickbook, Word, Excel, Novell, and all common software
- Supports Multiple 1D/2D Barcodes: Eyoyo QR code scanner scan with most 1D 2D barcodes with ease; 1D Barcodes: EAN, UPC, Code 39, Code 93, Code 128, UCC/EAN 128, Codabar, Interleaved 2 of 5, ITF-6, ITF-14, ISBN, ISSN, MSI-Plessey, GS1 Databar, Code 11, Industrial 25, Matrix 2 of 5, etc. 2D Barcodes: QR, DataMatrix, PDF417, and so on
- Supports Screen Scanning: The Eyoyo 2D scanner is capable of reading barcodes from smartphone screens, such as mobile coupons, digital wallets, and digital loyalty cards; Before scanning, simply turn your screen brightness to the maximum
- Sturdy Anti-Shock and Durable Design: The Eyoyo 2D barcode scanner features an ergonomic design made of high-quality ABS, enabling it to withstand repeated drops from 5 ft/1.5 m high onto the concrete ground; The durable plastic material ensures a long service life
Not every malicious code leads to a visible fake page. In campaigns described by the FBI, a QR code in a targeted message could lead through a redirector to a credential-stealing page; some campaigns may also seek session tokens or continued access to an account. A code’s appearance alone cannot establish whether its destination is safe.
Where do malicious QR codes show up?
- Emails and messages: A QR image may be included in a targeted phishing message to persuade someone to continue on a phone. The FBI reported examples involving a purported questionnaire, a secure-drive lure, and a fake conference-registration page that led to a Google-account credential-harvesting page. These are examples from specific campaigns, not a measure of how common the tactic is.
- Unexpected packages: An unsolicited parcel may include a code that prompts the recipient to provide information or download software. The FBI has warned about this kind of fraud.
- Public or posted codes: A criminal can cover a legitimate code with a replacement sticker that sends people to a different destination. The FBI has warned consumers to watch for altered codes. FBI El Paso’s QR-code scam guidance explains precautions for physical codes.
How can you tell if a QR code may be a scam?
You often cannot tell from the QR pattern itself. Judge the source, the destination preview, and any request the page makes. Be especially cautious when a code arrives unexpectedly or when the linked page asks for credentials, payment information, a download, or permissions that do not fit the task.
Rank #2
- 【Battery Level Indicator and 2200mAh Capacity】Larger battery enables longer continuous usage and twice the stand-by time of others. With the unique battery indicator light showing the remaining battery level, no more Low Battery Anxiety.
- 【Ergonomic Design】 The curved handle is extended and thickened, tailor-made for North America customers. Specially designed smooth and flat trigger for better grip. 【Package Includes】Barcode Scanner x1, USB Cable x1, Dongle x1, User Manual x1.
- 【Anti-Shock Silicone】 The orange anti-shock silicone protective cover can avoid scratches and friction while falling from the height of 6.56 feet. IP54 technology protects the wireless barcode scanner from dust.
- 【2.4 GHz Wireless plus USB 2.0 Wired Connection】 Plug and play with the USB receiver or the USB cable, no driver installation needed. Easy and quick to set up. Wireless transmission distance reaches up to 328 ft. in barrier free environment.
- 【Digital and Printed 1D 2D QR Bar Code Symbologies】1D: Codabar, Code 11, Code93, MSI, Code 128, UCC/EAN-128, Code 39, EAN-8, EAN-13, UPC-A, ISBN, Industrial 25, Interleaved 25, Standard25, Matrix 2D: QR, DataMatrix, Aztec, Hanxin, Micro PDF417. (Note: Not compatible with Square.)
- Check whether a physical code looks like a sticker placed over another code or otherwise appears altered. If it may have been tampered with, reach the service through its official app or by typing its known website address instead.
- For an unexpected code from someone you know or an organization you use, confirm the request using a separate, trusted contact method—not the details in the same message.
- Do not treat a familiar logo, a professional-looking page, or a known sender name as proof that a link is genuine.
- If a page asks you to sign in or grant a permission, stop and visit the service through its usual app or website before proceeding.
What should you do if you scanned a suspicious QR code?
If you only scanned the code and opened a page, that alone does not prove your phone is compromised. Close the page, do not enter information or approve unexpected prompts, and verify the request through a known route. If you downloaded an app, granted permissions, entered a password, or made a payment, take steps based on what you shared or approved.
- Entered a password: Go directly to the real service through its official app or a known website address and change the password. If you reused it elsewhere, change it on those accounts too.
- Approved an unexpected permission or installed an app: Review the device’s installed apps and permissions, and remove or revoke anything you do not recognize. Use the device maker’s official support guidance if you are unsure how.
- Shared financial details or sent money: Contact your bank or payment provider using the number on your card or its official app, explain what happened, and ask what protective steps are available.
- Suspect fraud: The FBI advises reporting suspected QR-code fraud to the Internet Crime Complaint Center (IC3). Include relevant details such as the message, website, phone number, and any app downloaded or permissions granted. FBI Internet Crime Complaint Center.
Is every QR code unsafe?
No. QR codes are a way to encode information; the image itself does not reveal whether the destination is trustworthy. A code from a known, expected source may be legitimate, but an unexpected request still deserves independent verification. The FBI’s cited advisories describe particular scams and campaigns; they do not provide a general prevalence estimate for malicious QR codes.
Quick Recap
Best Value
- 【IP66 Waterproof Dustproof Mini Pocket 2D Scanner】Just bring this scanner with you. Anytime you want to collect data, just connect it with your device via Bluetooth or use the storage mode. 【Package Includes】Barcode Scanner x1, USB Cable x1, Dongle x1, User Manual x1.
- 【Waterproof Dustproof Silicone Port Plug】Newly designed waterproof and dustproof silicone port plug on marketplace, it enables better performance of the scanner in every working conditions. The silicone button on the scanner body enables every soft and smooth scanning experience.
- 【3-in-1 Connection Ways】This scanner works with Bluetooth, 2.4GHz wireless and USB 2.0 wired mode. The transmission distance can be 656ft in barrier free environment and 98 ft in an environment with obstacles using a 2.4G USB dongle. In addition, it is also compatible with various operating systems, such as windows 11/10/8/7/xp, Mac OS, iOS, android, linux.(Note: Not Compatible with Square)
- 【Vibration Alert】: When you need a quiet working environment, just turn the volume off and the vibration function will let you know if a barcode is detected.
- 【1D 2D QR Scanner】：Supports Both Digital and Printed 1D 2D QR Bar Code Symbologies: 1D Decode Capability: Codabar, Code 11, Code93, MSI, Code 128, UCC/EAN-128, Code 39, EAN-8, EAN-13, UPC-A, ISBN, Industrial 25, Interleaved 25, Standard 25, 2/5 Matrix 2D Decode Capability: QR, PDF417, Data Matrix, Aztec code, Maxi Code.
Rank #4
- 【Unique Designed Screen Setting】It allows you to customize the screen display according to your preferences. With this innovative feature, you can easily set the language, adjust volume settings, select connection options, and view stored and total barcodes. Experience unparalleled convenience and flexibility as you personalize the settings of your Tera HW0009 to suit your specific needs. 【Package Includes: Barcode Scanner x1, Charging Cradle x1, Charging Cable x1, User Manual x1】
- 【Superior Global CMOS Imaging Scanning】This advanced scanner excels in fast and accurate reading of both ordinary and high-density barcodes, including challenging formats like PDF417 found on driver's licenses. Its exceptional performance effortlessly handles various scanning scenarios, including underwater scanning, reading barcodes on silver paper, reflective materials, and more.
- 【Charging Cradle & 2500mAh Large Battery】Designed with a convenient charging cradle, the HW0009 barcode scanner allows you to easily charge it whenever it's not in use. In addition, the scanner itself is equipped with a powerful 2500mAh battery, ensuring seamless all-day operation without the need for frequent charging.
- 【3-in-1 Connections & Widely Compatible】 Tera HW0009 wireless barcode scanner can work with bluetooth & 2.4G wireless & usb wired. The transmission distance can be 328ft in barrier free environment and 114ft in obstacles environment using 2.4G USB dongle. It can be connected with a variety of devices, such as smartphones, computers, POS, tablets. In addition, it is also compatible with various operating systems, such as windows 11/10/8/7/xp, Mac OS, iOS, android, linux.
- 【1D 2D QR code Programmable】2D: QR code, Data Matrix, PDF417(including PDF417 on driver’s license), Aztec, Maxicode, Micro QR, Micro PDF417; 1D: UPC/EAN, Code 128/EAN128, GS1-128, ISBT-128, Standard 2 of 5, Matrix 2 of 5, Code 39, Code 32, Code 93, Code 11, Codabar, PLESSEY, MSI, GSI Databar, ITF-14, GS1.
Rank #3
- 【Battery Level Indicator and 2200mAh Capacity】Larger battery enables longer continuous usage and twice the stand-by time of others. With the unique battery indicator light showing the remaining battery level, no more Low Battery Anxiety.
- 【Ergonomic Design】 The curved handle is extended and thickened, tailor-made for North America customers. Specially designed smooth and flat trigger for better grip. 【Package Includes】Barcode Scanner x1, USB Cable x1, Dongle x1, User Manual x1
- 【Anti-Shock Silicone】 The orange anti-shock silicone protective cover can avoid scratches and friction while falling from the height of 6.56 feet. IP54 technology protects the wireless barcode scanner from dust.
- 【2.4 GHz Wireless + USB 2.0 Wired Connection】 Plug and play with the USB receiver or the USB cable, no driver installation needed. Easy and quick to set up. Wireless transmission distance reaches up to 328 ft. in barrier free environment.
- 【Digital and Printed 1D 2D QR Bar Code Symbologies】1D: Codabar, Code 11, Code93, MSI, Code 128, UCC/EAN-128, Code 39, EAN-8, EAN-13, UPC-A, ISBN, Industrial 25, Interleaved 25, Standard25, Matrix 2D: QR, DataMatrix, PDF417, Aztec, Hanxin, Micro PDF417. (Note: Not compatible with Square.)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
