How do I scan QR codes?
Most smartphones have built-in QR scanners, which are sometimes built in the camera. A QR scanner is simply a way to scan QR codes.
Some tablets, such as the Apple iPad, have QR readers built into their cameras.
Some older devices may require a particular app to read QR codes – these apps are readily available on the Apple App Store and Google Play.
Scanning a QR code using your device is straightforward:
Open the QR reader application or the camera on your smartphone.
Point it at the QR code – you should be able to point your camera from any angle and still receive the necessary information.
The data will be instantly shown on screen – for instance, if the QR code contains contact details, your phone should instantly download these.
Are QR codes safe?
Attackers can embed malicious URLs containing custom malware into a QR code which could then exfiltrate data from a mobile device when scanned. It is also possible to embed a malicious URL into a QR code that directs to a phishing site, where unsuspecting users could disclose personal or financial information.
Because humans cannot read QR codes, it is easy for attackers to alter a QR code to point to an alternative resource without being detected. While many people are aware that QR codes can open a URL, they can be less aware of the other actions that QR codes can initiate on a user’s device. Aside from opening a website, these actions can include adding contacts or composing emails. This element of surprise can make QR code security threats especially problematic.
A typical attack involves placing malicious QR codes in public, sometimes covering up legitimate QR codes. Unsuspecting users who scan the code are taken to a malicious web page which could host an exploit kit, leading to device compromise or a spoofed login page to steal user credentials. Some websites do drive-by downloads, so simply visiting the site can initiate a malicious software download.
Mobile devices, in general, tend to be less secure than computers or laptops. Since QR codes are used on mobile devices, this increases the potential risks.
Do QR codes collect my personal information and data?
QR code-generating software does not collect personally identifiable information.
The data it does collect – and which is visible to the code’s creators – includes location, the number of times the code has been scanned and at what times, plus the operating system of the device which scanned the code (i.e., iPhone or Android).
Can someone hack a QR code?
The QR codes themselves can’t be hacked – the security risks associated with QR codes derive from the destination of QR codes rather than the codes themselves.
Hackers can create malicious QR codes which send users to fake websites that capture their personal data such as login credentials or even track their geolocation on their phone.
This is why mobile users should only scan codes that come from a trusted sender.
Uses of QR Code
Augmented reality
QR codes are used in some augmented reality systems to determine the positions of objects in 3-dimensional space.
Displaying multimedia contents
QR codes also used to direct users to specific multimedia content (such as videos, audios, images, documents and any type of content accessible from the web). This type of QR code is called "Multimedia QR code".
Mobile operating systems
QR codes can be used on various mobile device operating systems. iPhones running on iOS 11 and higher and some Android devices can natively scan QR codes without downloading an external app. The camera app is able to scan and display the kind of QR code (only on iPhone) along with the link (both on Android and iPhone). These devices support URL redirection, which allows QR codes to send metadata to existing applications on the device. Many paid or free apps are available with the ability to scan the codes and hard-link to an external URL.
Virtual stores
QR codes have been used to establish "virtual stores", where a gallery of product information and QR codes is presented to the customer, e.g. on a train station wall. The customers scan the QR codes, and the products are delivered to their homes. This use started in South Korea, and Argentina, but is currently expanding globally. Walmart, Procter & Gamble and Woolworths have already adopted the Virtual Store concept.
QR code payment
QR codes can be used to store bank account information or credit card information, or they can be specifically designed to work with particular payment provider applications. There are several trial applications of QR code payments across the world. In developing countries like China, India and Bangladesh QR code payment is a very popular and convenient method of making payments. Since Alipay designed a QR code payment method in 2011, mobile payment has been quickly adopted in China. As of 2018, around 83% of all payments were made via mobile payment.
Website login
QR codes can be used to log into websites: a QR code is shown on the login page on a computer screen, and when a registered user scans it with a verified smartphone, they will automatically be logged in. Authentication is performed by the smartphone which contacts the server. Google tested such a login method in January 2012.
Mobile ticket
There is a system whereby a QR code can be displayed on a device such as a smartphone and used as an admission ticket. Its use is common for J1 League and Nippon Professional Baseball tickets in Japan. In some cases, rights can be transferred via the Internet.
Restaurant ordering
Restaurants can present a QR code near the front door or at the table allowing guests to view an online menu, or even redirect them to an online ordering website or app, allowing them to order and/or possibly pay for their meal without having to use a cashier or waiter. QR codes can also link to daily or weekly specials that are not printed on the standardized menus, and enable the establishment to update the entire menu without needing to print copies. At table-serve restaurants, QR codes enable guests to order and pay for their meals without a waiter involved – the QR code contains the table number so servers know where to bring the food. This application has grown especially since the need for social distancing during the 2020 COVID-19 pandemic prompted reduced contact between service staff and customers.
Joining a Wi‑Fi network A QR code to automatically join a Wi‑Fi network
By specifying the SSID, encryption type, password/passphrase, and if the SSID is hidden or not, mobile device users can quickly scan and join networks without having to manually enter the data.[57] A MeCard-like format is supported by Android and iOS 11+.[58]
Common format: WIFI:S:<SSID>;T:<WEP|WPA|blank>;P:<PASSWORD>;H:<true|false|blank>;;
Sample: WIFI:S:MySSID;T:WPA;P:MyPassW0rd;
Funerary use A QR code which links to an obituary and can be placed on a headstone
A QR code can link to an obituary and can be placed on a headstone. In 2008, Ishinokoe in Yamanashi Prefecture, Japan began to sell tombstones with QR codes produced by IT DeSign, where the code leads to a virtual grave site of the deceased. Other companies, such as Wisconsin-based Interactive Headstones, have also begun implementing QR codes into tombstones. In 2014, the Jewish Cemetery of La Paz in Uruguay began implementing QR codes for tombstones.
Electronic authentication
QR codes are also used to generate time-based one-time passwords (TOTP) for electronic authentication.