QRCard AI

Is it safe to scan? A plain answer, before you point your phone at that code

Trust in a printed QR code has two sides — the person holding the phone, and the person who printed the paper. This page speaks to both, without fear-mongering and without pretending the risks are not real. What changed in the last few years is not the technology; it is that scammers learned to paste a code over a real one, and that the "free" QR generator you used in 2019 turned into a paid service, changed hands, or disappeared — and the paper on the wall kept pointing at whatever it points at today.

① The real risk

What actually goes wrong

Almost every QR incident on the news is one of these three shapes. Knowing which shape you are looking at tells you what to do.

SHAPE 1

A sticker over a real code

Parking meters, bike-share docks, restaurant table tents and public Wi-Fi signs have been the highest-profile cases. Someone prints a fake code on a sticker, pastes it over the real one, and directs you to a copycat payment page.

SHAPE 2

The middle layer you rented disappears

A dynamic QR points at an address the vendor controls. When the vendor is acquired, changes pricing or shuts down, the printed code follows the middle layer to somewhere you did not sign up for — or nowhere.

SHAPE 3

The landing page asks for something it doesn't need

Once you are through the door, a page that wants a password you already have on a real account, or your card details for what looked like a free menu, is the same red flag as any phishing link. The code did its job; the page is where to be careful.

② For the person scanning

Four habits that cover almost everything

→Look at the preview URL before you open it. The phone camera shows a small banner at the bottom of the screen with the address the code points to. Take one second to read the domain — not the path, just the domain part between "//" and the next "/".

→Do not scan a code you did not go looking for. If it was stuck over another code, or added to a poster that did not have one, treat it like an unfamiliar hyperlink in an email — the safe answer is "no".

→Payment for something free is a red flag. A menu, a form to join an event, a Wi-Fi sign-up, a photo gallery — none of them need your card details. If the page asks, stop and go find the real service directly.

→Do not re-enter a password you already have. A page asking you to "confirm" your email, bank or government login on top of a scan is either phishing or an impersonation. Legitimate publishers have your password already.

A note on QRCode scams in the news

In 2024 and 2025 law-enforcement agencies in several countries warned about parking-meter and bike-share scams that used QR stickers. The warnings are real and the mechanism is exactly shape 1 above. They are not a reason to stop using QR codes in general — they are a reason to look at the domain banner before you tap through, which takes one second.

③ For the publisher

If you print cards, you are the middle layer for someone else

Anyone whose printed code points at a service they don't control inherits that service's fate. Four questions are worth asking before a print run.

ASK 01

Whose domain is on the printed code?

If the URL is a vendor's, the vendor is the destination for that paper. If they change plans, redirect or disappear, you reprint — or you don't. Choose a vendor whose domain you can live with for years, or one that lets you point at your own.

ASK 02

What happens if the plan changes?

A subscription that carries your printed codes is a dependency. Ask what the code shows when the plan lapses — a hard 404, a soft "publisher no longer active", or a redirect to somewhere else. Those are very different experiences for the person scanning.

ASK 03

Can you export everything you collected?

The paper is only the entry. The responses are the point. If the CSV lives behind a paid plan, you have rented storage for your own data. Free export on every tier is a much safer shape.

ASK 04

Is there a hidden paywall after "free"?

A well-known QR vendor has publicly been criticised for signing people up to a paid plan without a clear warning at signup. If the pricing page buries the cost, walk away — a card you cannot print without a credit card isn't free.

Where QRCard AI stands

Every card we print points at qrcard-ai.com/c/<shortId> — our own domain, not a rented middle layer. Free cards do not expire, do not sit behind a credit card, and CSV export is on every tier. When a card closes, a scan still lands on the same qrcard-ai.com page and reads "this card is no longer collecting" — the printed identity does not get quietly redirected somewhere else. When a card is deleted or the service ever goes dark, the code hits our own plain 404 landing page. That is the whole promise, and it is written on our terms.

④ Before the print run

A two-minute check that stops reprinting thousands

The scannability rules are on How Cards Work. The safety check is different — it asks whether the destination still belongs to you after print. Three checks, in order.

  1. 01

    Open the code with a phone camera, not an app

    The system camera is what most of your audience uses, and it shows the preview URL before you tap through. If the preview is on the vendor's domain (yours or theirs), that is what will be printed forever.

  2. 02

    Edit the destination once, deliberately

    Change the URL to something obviously wrong, reprint the code from the same test print — if the printed code follows the change, you have a real dynamic card. If it does not, the vendor is printing static images, and you will need to reprint forever.

  3. 03

    Export the responses and delete one you added

    Own the round trip. If the export opens in Excel and the deletion is real, you can trust the data is yours. If the export asks you to upgrade, print fewer cards and pick a different vendor.

FAQ

Three questions people ask

Should I stop scanning QR codes?

No — treat them like links. A code pasted over a real one on a parking meter or a menu stand is the same risk as clicking an untrusted link: don't scan it if the source is unclear. A code you sought out at a venue, from a card the vendor handed you, or from a package you bought, is normally safe.

How do I check a code before committing?

Two habits do most of the work. First, look at the domain the phone camera previews before you open it — a QRCard AI code always resolves to qrcard-ai.com/c/xxxxx, so you can see the card's identity before you tap through. Second, if the page asks for a payment credential, an ID number, or a password you already have on a real account, back out and go to the source directly.

What is the middle layer and why does it matter?

A dynamic QR points at an address you are trusting, not at a final destination. The address is the middle layer: whoever controls it controls where the code goes today. If the vendor of that address disappears, changes the plan or is compromised, the printed code follows. A middle layer you own (your domain, your export, your data) is a safer shape than one you rent.

Print a card you would scan yourself

A free QR Card runs on our own domain, exports CSV without a pay wall and does not expire. The paper is only as trustworthy as the middle layer behind it — pick one you would stand behind.

Make a Card — Free