Images tower · floor

How to scan a QR code on iPhone, and what to check first

The answer to how to scan a QR code on iPhone is three steps long and Apple publishes it, which is why the first result for this question is Apple. There is no reason for anybody to write a longer version of those three steps, so this floor gives them and then spends its time on the part nobody covers.

Two sources that do not reference each other, describing the same moment. Apple built a pause into the interaction — the link is shown rather than followed — and a federal consumer agency, writing about a different subject entirely, tells you to use exactly that pause. Neither page mentions the other. Put together they give you the whole instruction: scan, read the address, then decide.

What to actually look for in that second. The domain, and only the domain — the part immediately before the first single slash. Everything after it can say anything at all, and scammers rely on people reading the reassuring words further along. A real bank link ends its domain at the bank’s name; a fake one puts the bank’s name somewhere later in a longer address that belongs to someone else.

Then the FTC’s spelling check: “look for misspellings or a switched letter”. A single transposed character is the standard trick, and it is invisible unless you are looking for it.

And the situational rule, which is the strongest of the three: “Don’t scan a QR code in an email or text message you weren’t expecting — especially if it urges you to act immediately.” The urgency is not incidental to these messages; it is the mechanism. If it were not urgent you would have time to check, and checking is what they cannot survive.

Where the codes are riskiest, and it is not online. The parking meter example matters because it inverts the usual advice. People are cautious about links in emails and trusting of objects in the street — but a sticker on a meter, a table card in a café, a poster at a bus stop or a flyer on a windscreen can be replaced by anybody with a printer. A printed code carries no signature and no sender. It is the least verifiable link you will ever be offered, and it looks the most official.

The practical version, if you want one line. Treat a QR code as a link from a stranger, because that is what it is until you have read the address. That costs you half a second and it is the entire defence.

If the code will not scan. Apple gives two alternatives worth knowing. The Control Centre has a Scan Code control you can add — “If you don’t see the Scan Code control, add it to Control Centre” — and there is a small tip on the same page that solves most failures: “Tap the flashlight to add more light.” Poor light and a shallow angle account for nearly every code that will not read.

What the FTC says to do beyond the moment itself: “Update your phone’s OS to protect against hackers and protect your online accounts with strong passwords and multi-factor authentication.” That is the part that limits the damage when somebody does eventually tap the wrong thing — and everybody eventually does.

The steps here are quoted from the iPhone User Guide and the warnings from a Federal Trade Commission consumer alert of December 2023, each read on 21 August 2026. The point about reading the domain rather than the rest of the address is ours.

What this tower will not do

It will not recommend a QR scanner app. Apple builds it into the Camera, and two of the pages ranking for this question are published by companies selling one.

It will not tell you QR codes are dangerous. They are links, with the same risks and the same defence — reading the address before you follow it.

And it will not paraphrase the federal warning. It is quoted above with its date, because that is a subject where the exact wording matters. What holds instead is simple: the steps are quoted from the iPhone User Guide and the warnings from a Federal Trade Commission consumer alert, each with the date it was read.