Before You Scan: How QR Codes Work—and How to Spot a Dangerous One

Category: Innovation | Published: 10/1/2026

A QR code can hide a useful shortcut or a risky destination. Learn how the grid works, what your phone decodes, and how to check before you tap.

A QR code is a machine-readable grid that can store text, contact details, or a web address. Your phone’s camera detects the pattern, software reconstructs the grid, corrects some damaged data, and decodes the stored message. The important safety point is simple: a QR code is a container, not a guarantee. You cannot judge the destination by looking at the squares, so preview the link, verify the exact domain and source, and pause before entering a password, payment detail, or personal information.

QR codes are useful in classrooms, libraries, restaurants, posters, tickets, payments, and museum exhibits. They can also hide a misleading link. Understanding both the technology and the decision you make after scanning turns a mysterious square into something you can evaluate calmly.

What is a QR code?

QR stands for “Quick Response.” The code was developed by DENSO WAVE for fast, reliable identification. Unlike a one-dimensional barcode, which arranges information mainly across lines, a QR code uses a two-dimensional grid of small dark and light squares called modules. Because the information is arranged both across and down, the symbol can hold more data in a compact space.

The three large square markers near the corners are position-detection patterns. They help a reader find the code and understand its orientation, which is why a standard QR code can be read even when it is rotated. Other areas help the reader determine spacing, alignment, format information, and the data itself. The exact layout changes with the code’s version and the amount of information stored.

How do QR codes work?

When you point a compatible camera or scanner at a QR code, several steps happen quickly:

The camera captures an image. The phone sees pixels, not meaning.
The reader finds the corner markers. These distinctive patterns help it locate and orient the code.
The image is straightened. Software compensates for rotation and some perspective distortion so it can map the grid accurately.
The modules are read. The pattern of light and dark squares is translated into encoded bits of information.
Error correction is applied. Extra mathematical data can allow the message to be recovered when part of the symbol is dirty, scratched, or obscured.
The payload is decoded. The result might be plain text, a web address, Wi-Fi information, contact details, or another supported action.
The phone presents a choice. Many phones show a preview or notification before opening a destination. That preview is your most important checkpoint.

According to DENSO WAVE, standard QR codes support four error-correction levels. Higher levels add more recovery information but leave less room for the original message at the same symbol size. Error correction is why a partly damaged code may still scan; it does not certify that the content is trustworthy.

What can a QR code actually contain?

A QR code stores data. Sometimes that data is the full destination address. In other cases, the code contains a short redirect link that sends the browser somewhere else. It may also contain text, a telephone number, an email address, event details, or network information.

This distinction matters: the visible poster and the hidden destination are separate things. A school logo beside a code does not become part of the encoded evidence. A professionally printed code is not automatically safer than a handwritten one. Trust must come from the source, the destination, and the action being requested—not from the pattern itself.

Why can a QR code be risky?

The black-and-white grid hides the destination until software decodes it. Scammers take advantage of that gap. They may place a sticker over a legitimate payment code, include a code in an unexpected email, or create a fake sign that imitates a familiar organization. The decoded page may copy a real login screen and ask for a school password, banking information, or a verification code.

The U.S. Federal Trade Commission advises people to inspect the URL before opening an unexpected QR destination and to watch for misspellings or substituted letters. CISA’s broader phishing guidance also emphasizes recognizing urgency, suspicious requests, and links designed to make people act before checking.

Scanning alone does not prove that harm has occurred. The risk increases when a person opens an unverified destination, downloads an unexpected file, grants permissions, sends money, or enters sensitive information. Treat the scan as the beginning of a decision, not the end of one.

The SCAN check before you open a QR link

S — Source: Who placed or sent the code?

Consider where the code appeared and whether you expected it. A code inside a teacher’s verified learning platform is different from one on an unknown hallway sticker or an urgent message from an unfamiliar sender. On a public sign, check for a sticker placed over another code, unusual edges, mismatched branding, or damage suggesting tampering.

C — Check the preview carefully

Read the destination shown by your phone before opening it. Focus on the actual domain—the central registered name—not just words elsewhere in a long address. A familiar brand name in the path does not make an unfamiliar domain official. Look for misspellings, extra letters, confusing substitutions, and shortened links that conceal the final destination.

https://school.example.org/payment and https://school-example-login.example.net are not the same domain. If the preview is cut off or difficult to interpret, do not guess.

A — Access the organization another way

If the code asks you to sign in, pay, update an account, or act urgently, open the organization’s known app or type its official website yourself. For a school request, confirm it through the learning platform, a known staff contact, or the school’s published contact information. For a payment sign, use the official app or website rather than trusting a sticker.

N — Never enter sensitive information until verified

Pause before entering passwords, card details, identification numbers, one-time security codes, or other personal information. A padlock or https shows that the connection is encrypted; it does not prove that the organization behind the site is honest. If anything feels inconsistent, close the page and ask a trusted adult, educator, or the organization itself.

Four realistic QR-code situations

A classroom worksheet

A teacher posts a QR code linking to a simulation. The safest route is to confirm that the code appears in the teacher’s usual platform and that the preview points to the expected educational domain. Younger students can ask an adult to open it with them.

A poster promising a prize

The sign says “Scan in the next five minutes or lose your reward.” Urgency and a reward are reasons to slow down. Do not enter a school login or personal details. Search for the program through its official channel instead.

A payment code in a public place

Before paying, inspect whether the code looks like a replacement sticker. Compare the destination with the organization’s official website or payment app. A small spelling change can lead to an imitation page.

A QR code inside an email

A code in an email can move the decision from a computer to a phone, where the destination may be harder to inspect. If the message is unexpected or asks for immediate verification, do not scan it. Contact the sender using details you already trust.

What should you do if you opened a suspicious QR link?

If you only opened the page, close it and do not download anything, grant permissions, or enter information. If you entered a password, go directly to the real service, change that password, sign out other sessions if the service allows it, and turn on multifactor authentication. Change the password anywhere else it was reused. Tell a trusted adult, school technology administrator, or the affected organization when appropriate.

If you entered payment or identity information, contact the financial institution or relevant organization through its official channel and follow its fraud-reporting steps. Keep the suspicious message or a safe screenshot for reporting, but do not continue interacting with the page.

A simple investigation students can try

Use a QR-code generator approved by your teacher or family to encode a short, harmless sentence—not personal information. Scan it and record what your phone previews before you open anything. Then compare a small code with a larger one, rotate the page, and partly cover a corner or edge. Observe which changes affect detection and decoding.

The goal is not to test suspicious codes. It is to see how orientation markers, contrast, size, and error correction affect a code you created yourself. Older students can compare a direct URL with a redirect link and explain why the second is harder to evaluate from a preview.

Takeaways for students, families, and educators

Students: Preview first. A QR code saves typing, but it should not replace judgment.
Families: Practise reading domains together and agree that stopping to verify is a smart response, not an overreaction.
Educators: Place codes in trusted course spaces, label the expected destination in ordinary text, and avoid requiring students to scan unexplained codes.
Everyone: Use official apps or known websites for logins, payments, and account recovery.

Sources

A QR code is neither safe nor dangerous by itself. It is a compact way to carry information. The safer habit is to separate scanning from trusting: decode the message, inspect the destination, verify the source, and choose your next action deliberately.

← Back to Blog