What a Scan Can and Cannot Ask For
A QR code is only text: a link, a contact, Wi-Fi details, or similar. It has no power on its own. The moment you scan it, your phone hands that text to an app — the browser, the contacts app, the Wi-Fi settings, or a payment app — and that app may then ask for a permission. The permission belongs to the app, not to the code, which is why the same code can behave differently in the camera app, in a messaging app, or on a desktop browser.
The only permission every scan needs
Every scan needs the camera, because the device has to see the code. On iOS and Android the camera permission is granted once to the camera app; in-app scanners ask for it inside that app; desktop scanners ask the browser for webcam access per site. If you have never granted it, the scanner simply shows a prompt instead of a viewfinder. Revoking camera access later stops scanning until you grant it again — it does not delete anything.
Permissions that come after the scan
Everything else is requested by whatever opens next. Saving a contact asks for contacts access. Joining Wi-Fi asks you to confirm the network. Paying asks your payment app for its own confirmation, such as a PIN or fingerprint. Downloading an app opens the store, which has its own install approval. None of these happen silently on a modern phone: each one shows a prompt naming the permission and the app that wants it.
Red flags worth stopping for
- A code that promises one thing but asks for something unrelated — a menu code asking for contacts, or a Wi-Fi code asking to install an app.
- A payment prompt where the recipient name or amount differs from what the poster promised.
- A link preview whose domain does not match the business on the sign.
- A scanner app that demands broad permissions, such as full contacts or location, just to read a code.
When in doubt, close the prompt, check the destination with the address bar or link preview, and re-scan only once the permission list matches what the code promised.