Can You Get a Virus from a QR Code?

No — a QR code cannot itself contain a virus. A QR code is a printed encoding of a short string of text, and text is not executable. There is no mechanism by which the pattern of black and white squares can run code on your phone.

But that is not the same as saying scanning is always safe, and pretending otherwise would be dishonest. The realistic question is not whether you can get a virus from a qr code — it is what the text inside it points you to, and what you do next. Almost every real QR-related security incident is a phishing or fraud problem dressed up as a technical one: the code takes you to a convincing fake page, and the damage happens when you enter a password, approve a payment or install something.

This guide covers what can and cannot actually happen, and what to do at the moment of the scan.

A QR code stores a string — typically under 300 characters for anything printed in the real world. That string might be a URL, a phone number, a Wi-Fi configuration, a payment request or plain text. Our how QR codes work explainer covers the encoding in detail.

What a QR code cannot contain:

• An executable file. There is no mechanism to encode and auto-run a program. Even at maximum capacity a QR code holds roughly 2,953 bytes — smaller than almost any real piece of software, and in any case the scanner treats the content as text, not as code.
• A script that runs on scan. Your camera app decodes the string and displays it or offers an action. It does not execute anything.
• Anything that acts without your involvement. Every real consequence of a scan requires at least one further action from you — tapping a link, entering data, approving a request, installing an app.

That last point is the important one, and it is genuinely empowering: the scan itself is not the dangerous step. The dangerous step always comes after.

The real risks, in rough order of how often they cause actual harm in India:

• Phishing pages (quishing). The code opens a convincing replica of a bank, wallet, delivery-tracking or government portal, and asks for credentials, card details or an OTP. This is by far the most common and most costly pattern.
• Fraudulent payment requests. A scan opens a UPI collect request or a pre-filled payment. The classic version is the "scan to receive money" trap — you never scan a code to receive money, only to send it. Any code presented as a way to receive a refund or a prize is fraudulent by construction.
• Swapped stickers on legitimate codes. A fraudulent sticker pasted over a genuine shop or parking-payment QR routes your money to someone else's account. The shop is real, the placement is real, the code is not.
• Drive-by download prompts. A malicious page can prompt you to download an APK or install a profile. This cannot happen silently — you have to accept the prompt and, on Android, explicitly allow installation from an unknown source.
• Tracking and fingerprinting. Less dramatic but real: an opened page can log your IP, device and approximate location. This is ordinary web behaviour, not malware, and it applies to any link you open.

It is worth grounding this in real reported figures rather than alarm.

The Reserve Bank of India's Annual Report for 2024-25 recorded 11,615 fraud cases in the banking system involving ₹3,497 crore, down from 35,530 cases and ₹5,856 crore the previous year — a substantial decline in both count and value. Within that, card and internet frauds made up 66.8% of cases by number (7,756 incidents) but only 7.2% of the amount, at ₹252 crore.

That pattern is worth reading carefully, because it says something useful: digital-channel fraud in India is high in frequency and low in average value. These are large numbers of small, opportunistic scams targeting individuals, not a few sophisticated technical breaches. Which is exactly the shape of QR-based fraud — a swapped sticker at a petrol pump, a fake refund page, a ₹500 payment that goes to the wrong account.

The practical implication is reassuring in one way and sobering in another. You are very unlikely to encounter a sophisticated technical exploit through a QR code. You are meaningfully likely to encounter a social-engineering attempt — which is defeated by attention rather than by antivirus software.

A short, realistic checklist that covers the vast majority of risk:

• Read the URL preview before tapping. Every modern phone camera shows the destination before opening it. This single habit defeats most quishing attempts. Look at the domain — the part immediately before the first single slash — not at the rest of the string.
• Be suspicious of lookalike domains. sbi-verify.co is not sbi.co.in. hdfc-secure.in is not hdfcbank.com. Attackers rely on you reading the brand name and stopping there.
• Never enter an OTP, PIN or password on a page you reached by scanning an unsolicited code. Navigate to the service yourself, through its app or a bookmarked address, and check there.
• Never scan a code to receive money. UPI does not work that way. A code can only initiate a payment from you.
• Check physical codes for tampering. A sticker over a printed code, a peeling edge, a code that does not match the surrounding print quality — all worth a second look. Our guide to identifying a fake QR code covers this in detail.
• Do not install anything a scanned page asks you to install. Get apps from the Play Store or App Store, searched for yourself.
• Keep your phone updated. Browser and OS security patches are what protect you if you do land on a malicious page.

There is a category of apps promising to protect you by scanning QR codes "safely." For most people they add little, and they carry their own risks.

Your phone's built-in camera already does the one thing that matters: it shows you the destination before opening it. That is the entire protective mechanism, and it is free and built in. A third-party scanner adds a URL reputation check, which helps at the margin but is only as good as its blocklist — and newly created phishing domains, which is most of them, will not be on any blocklist yet.

Meanwhile, a third-party scanner app is an app with camera permission and full visibility of every code you scan, from a developer you may know nothing about. Many are ad-supported and some are aggressive about data collection.

The honest recommendation: use your phone's native camera, read the URL, and spend the attention on the preview rather than on installing another app.

If you are a business printing QR codes, customer hesitation is now a real conversion cost — and there are specific things that reduce it:

• Say where the code goes. "Scan for today's menu" beats a bare code, because uncertainty is what stops the scan.
• Use a branded short domain (Premium plan, ₹14,999/month). A URL preview showing your own domain is a verifiable trust signal at exactly the moment the customer is deciding.
• Inspect high-traffic placements regularly. A swapped sticker on your counter code harms your customer and your reputation, and you will usually be the last to find out.
• Never ask for an OTP or password on a page reached by scanning. If your own flow does this, you are training your customers into exactly the behaviour that gets them defrauded elsewhere.
• Watch your analytics for anomalies. An unexplained geographic or volume spike on a code is often the first visible sign something is wrong.

Our QR code security and quishing prevention guide covers the brand-protection side in full.

Create your QR code on SMLLR — with dynamic destinations you can change instantly if a link is ever compromised.