How to Scan a QR Code Safely on Android

QR codes are everywhere now: restaurant menus, parking meters, event tickets, product packaging, even flyers taped to lamp posts. They are convenient because one quick scan saves you from typing a long web address. That same convenience is what makes them attractive to scammers, because you cannot tell where a QR code leads just by looking at it. This guide shows you how to scan codes on an Android phone, how to check what a code contains before acting on it, and what to do if you think you scanned a bad one.

Ways to scan a QR code on Android

Most Android phones sold in the last several years can read QR codes without any extra download. The exact steps depend on your phone's manufacturer and Android version, so menu names may differ slightly from what you see here.

The built-in camera app

Open your camera, point it at the code, and hold steady for a second or two. On many phones a small banner or bubble appears with the link or text the code contains. Tap it only after you have read it. If nothing happens, look in your camera settings for an option named something like Scan QR codes and make sure it is turned on.

Google Lens and the Quick Settings tile

Google Lens can read QR codes and barcodes, either from the camera or from a screenshot or photo already saved on your phone. On many recent devices you can also swipe down from the top of the screen and look for a Scan QR code tile in Quick Settings. If it is not there, tap the pencil or edit icon to add it.

Dedicated scanner apps

A scanner app is useful if your camera does not support QR codes, if you scan often, or if you want a history of what you scanned. Choose one from a developer you recognize, read the permissions it asks for, and be wary of any scanner that wants access to your contacts, messages or call logs. A scanner needs the camera; it rarely needs much else.

Always preview the link before opening it

The single most useful safety habit is simple: read what the code contains before you tap anything. A good scanner shows you the full content first instead of opening it automatically. When you see a web address, check these details:

• The domain name. Look at the part just before the first single slash, such as example.com. Scammers use look-alike names with extra words, swapped letters or unusual endings.
• Shortened links. Link shorteners hide the real destination. They are not always malicious, but on a code that asks for money or a login, treat them as a reason to slow down.
• Unexpected actions. QR codes can do more than open websites. They can start a phone call, compose a text message, add a Wi-Fi network or download a file. If the action does not match what you expected, cancel it.

If you are unsure, do not open the link. Instead, type the organization's official website yourself or use its official app.

Warning signs of a malicious QR code

Consumer protection agencies in the United States, including the Federal Trade Commission, have warned people about QR code scams. Most of them share a few recognizable traits.

Stickers placed over the original code

One common trick is a printed sticker placed on top of a legitimate code, especially on parking meters, bike or scooter rentals, and payment signs. Run your finger over the code. If it feels like a separate label, is slightly crooked, peeling, or looks different from the rest of the sign, do not use it. Pay through the official app, the meter's keypad or coins, or the website printed on the sign itself.

Pressure and urgency

Be suspicious of codes that arrive with a deadline: "Your package could not be delivered, scan to reschedule," "Your account will be locked today," or "Pay now to avoid a fine." Real organizations rarely demand immediate action through a QR code on an unexpected letter, email or text.

Requests for payments or logins

A QR code that leads straight to a page asking for your bank password, email password, card number or a one-time verification code deserves extra caution. Legitimate sites do ask you to sign in, but you should only do so on a page you are confident about. When in doubt, close the page and sign in by opening the official app directly.

Codes in unexpected places

A QR code in an unsolicited email, a random flyer, or a package you did not order is a warning sign on its own. The same goes for codes that promise free gifts, prizes or cryptocurrency.

Settings that add a layer of protection

• Keep Android and your browser updated. Updates patch security holes that malicious pages may try to exploit. Check Settings > System > Software update (on some phones, Settings > Software update).
• Keep Google Play Protect on. Open the Play Store, tap your profile picture, then Play Protect, and make sure scanning is enabled.
• Block unknown app installs. Go to Settings > Apps > Special app access > Install unknown apps and make sure your browser and scanner are not allowed to install apps.
• Turn on safe browsing in Chrome. In Chrome, open Settings > Privacy and security > Safe Browsing.

What to do if you scanned a bad code

Opening a suspicious page is not automatically a disaster, but act quickly if you gave it anything.

1. Close the page without entering anything more. Do not download files it offers.
2. If you typed a password, change it right away on the real site, and change it anywhere else you used the same password. Turn on two-step verification if you have not already.
3. If you entered card or bank details, call your bank or card issuer using the number on the back of your card and ask them to watch for or block fraudulent charges.
4. If an app was installed, go to Settings > Apps, find any app you do not recognize, and uninstall it. Then run a Play Protect scan.
5. Report it. Tell the business or city that owns the sign or meter so they can remove the fake sticker. You can also report scams to the FTC at its official fraud reporting site.

A quick checklist

• Scan with a tool that shows the content before opening it.
• Read the domain name carefully.
• Check physical codes for stickers or tampering.
• Be skeptical of urgency, prizes and payment requests.
• When in doubt, go to the official app or website yourself.

If you want a scanner that keeps the preview step front and center, our QR & Barcode Scanner Launcher shows the decoded content before you choose what to do with it. Whatever tool you use, the habit of pausing to read is what keeps you safe.