Despite the FBI’s warning and the significant amount of press attention that followed, the reality is that most people probably don’t need to be overly concerned about QR attacks.

There is a lot of hacking folklore – which I call “hacklore” – floating around these days, and some of it comes from otherwise trustworthy organizations. We’ve seen warnings recently that scanning QR codes can lead to malware on your phone and bank account compromises. These alarms are sadly not backed up by the facts. While nothing is 100% secure, the phone manufacturers have done a good job making sure QR codes don’t create a security problem for you. — Bob Lord, former CSO at the Democratic National Committee and CISO at Yahoo

While it’s theoretically possible to embed malware into a QR code in the same way that it’s possible to embed a game of Snake, it’s never actually been done. At least, not as far as either we or Bob Lord know. The reality is that phones are quite secure and it would be extremely hard to pull off such an attack. Bottom line: scanning a QR code isn’t going to result in malware being silently installed onto your phone, meaning this is not something you need to worry about at this point in time. Phishing-based attacks, however, are a real risk and, as noted above, there have actually been some real-world cases. Such incidents are, however, very rare. You’re far more likely to encounter a phishy email than a phishy QR code.