QR codes are ordinary infrastructure in China. You may scan one to order noodles, rent a power bank, enter a mini program, follow a public account or pay a cashier. The risk comes from treating every square code as harmless before seeing what it opens.
First identify the job
- Merchant payment code: your wallet should show the recipient and ask for an amount or confirmation.
- Your payment code: you display it to the cashier. Do not send a screenshot to a stranger.
- Ordering code: usually opens a restaurant mini program and table number.
- Rental code: creates a time-based order for a bicycle, locker or power bank.
- Login or verification code: can authorize another device or account action. Treat this as sensitive.
Checks that take ten seconds
- Look for a sticker pasted over another code.
- Confirm the code belongs to the counter, table or machine you are using.
- Read the merchant or mini-program name.
- Check the amount before using Face ID, fingerprint or PIN.
- Refuse requests to install an APK, configuration profile or security certificate.
- Give only permissions the service actually needs.
Do not “help verify” a stranger’s account
A stranger may say their WeChat (微信, Weixin) account needs another user to scan a verification code. You cannot reliably know what account or action you are authorizing. Decline and let official customer support handle it.
If you scanned the wrong code
If you only opened a page and entered nothing, close it. If you installed software, granted powerful permissions, entered credentials or approved payment, act immediately: remove suspicious access, change the relevant password through the official app, review wallet and bank activity, and contact the provider.
FAQ
Can a normal restaurant QR code ask for my phone number?
Some mini programs use login or membership flows, but you can ask staff for a paper menu or manual order instead of surrendering more information than you are comfortable sharing.
Is a code safe because it opens inside WeChat or Alipay?
No app can make every linked merchant or page trustworthy. Confirm the recipient, amount and requested action.
Official information to check
- Cyberspace Administration of China overview of QR-code security risks
- 2025 Ministry of Public Security anti-fraud handbook
If the code simply fails: use the separate QR and mini-program troubleshooting guide.