The short answer: you don’t need a special app. Open your phone’s regular Camera app, point it at the QR code, and tap the link that pops up. Before you tap, read the web address. If the code came in a text, an email or a letter you weren’t expecting, or it’s a sticker on a parking meter, don’t scan it. Go to the company’s real website yourself instead.
On an iPhone
- Open the Camera app and make sure it’s in Photo mode.
- Point it at the QR code so the code shows on the screen.
- Tap the yellow link that appears at the bottom of the screen (Apple).
You can also add a Scan Code button to Control Center (swipe down from the top-right corner). Apple’s guide shows how to add it. In a dark restaurant, the scanner has a flashlight button you can turn on (Apple).
On an Android phone
- Open your Camera app and point it at the QR code.
- Tap the link or notification that appears (Android).
Many Android phones also have a QR code scanner button in Quick Settings: swipe down from the top of the screen to find it. If the QR code is already on your screen, for example in an email, you can use Circle to Search on phones that have it (Android).
If nothing happens, wipe the camera lens, move a little closer or farther away, and hold still for a second or two.
QR code menus at restaurants
Many restaurants put a QR code on the table instead of handing out paper menus. Scan it the same way. The menu opens in your phone’s web browser. A few tips:
- You don’t need to download an app or create an account to read a menu. If the page asks for that, close it and ask your server for a paper menu. Most places still have one.
- Pinch outward with two fingers on the menu page to make the text bigger.
- Check that no one has stuck a second sticker over the restaurant’s code. The FBI warns that criminals sometimes cover real codes with their own (FBI).
- Be careful about paying through a QR code. If the page asks for card details, compare the web address with the restaurant’s name first, or just pay your server.
How to spot a fake QR code
A QR code is just a disguised web link, so scammers use them the same way they use links in fake texts. The FTC’s September 2026 alert warns about fake codes stuck on parking meters and pay stations that send you to look-alike payment pages (FTC, Sept. 2026). Other fake codes show up in emails, texts and letters claiming a package couldn’t be delivered, there’s a problem with your account, or someone used your account (FTC).
- Read the address before you tap. Look for misspellings or a switched letter in the company name (FTC).
- Don’t scan a code you weren’t expecting in an email, text or letter. Contact the company using a phone number or website you know is real (FTC).
- Pay for parking with the city’s official app or website, or with coins or a card at the meter, rather than a sticker code.
- Don’t download apps from a QR code. Get apps from your phone’s App Store or Google Play. The FBI also advises against downloading separate “QR scanner” apps, because your camera already does the job (FBI).
- Keep your phone updated and use strong passwords and two-step sign-in on your important accounts (FTC).
If you scanned a bad code
- Close the page. Don’t enter anything else.
- If you typed a password, change it right away on the real website.
- If you entered card or bank details, call the number on the back of your card and watch your statements.
- Report it at ReportFraud.ftc.gov (FTC).
