QR Code Scams: How to Check Before You Scan
Quick answer: Treat a QR code like a hidden link. Before opening it, inspect the physical code, preview the destination, check the domain for misspellings, and ask whether the request was expected. If it asks for a password or payment, open the organization’s official app or type its known website instead.
A QR code can be useful, but you cannot read its destination by looking at the pattern. Scammers exploit that uncertainty by covering a genuine code, adding one to an urgent message, or sending people to a convincing copy of a real website.
Common QR-code scam setups
- A sticker placed over the real code on a parking meter or sign.
- An unexpected delivery message asking you to reschedule.
- A fake account alert that says you must change a password immediately.
- A restaurant, event, or payment page with a misspelled domain.
- A code that leads to an app download outside the official app store.
A safe scanning checklist
| Check | What to look for |
|---|---|
| Physical surface | A raised edge, different print quality, or sticker covering another code. |
| Context | Was the code expected, and does the request make sense here? |
| URL preview | The correct spelling and domain, not merely familiar words somewhere in the address. |
| Urgency | Threats, short deadlines, prizes, or pressure to act without checking. |
| Requested action | Passwords, card details, verification codes, crypto, gift cards, or unknown apps. |
1. Inspect before you scan
On a public sign, look for a sticker placed over the original code. If a meter or menu looks altered, use another official payment method or ask staff. A professionally printed sign can still be copied, so the physical check is only the first layer.
2. Preview the destination without opening it
- Open your phone’s built-in Camera app and point it at the code. On some Android phones, use the QR scanner in Quick Settings or a camera QR mode instead.
- Pause when the link appears. Do not tap it yet. Read the displayed website address, especially the part immediately before the first slash.
- Compare that address with the organization’s website from its official app, a bookmark you already trust, or a sign you have confirmed with staff. If the preview is shortened, unclear, or different, stop and use that known route instead.
For example, pay.example.com belongs under example.com, while example.com.pay-now.test belongs under pay-now.test. The trusted name appearing earlier in a web address does not make it the real site. These are fictional examples; always check the actual organization’s domain. A secure-connection symbol alone does not prove the site is genuine.
3. Use a known route for sensitive tasks
If the code claims to come from a bank, delivery company, government service, or account provider, close the preview. Open the official app, use a saved bookmark, or type the website you already know. Contact the organization through a number from its official site—not one displayed beside the suspicious code.
4. Do not install an unexpected app
A QR code can lead to a copycat app or harmful download. If an app is genuinely required, find it through the device’s official app store or the organization’s known website. Check the developer and requested permissions before installing. Our fake apps and copycat websites guide shows the checks in more detail.
What to do if you already scanned it
If you only opened the page: close it, do not download anything, and clear any permission you granted. An opened page does not automatically mean every account is compromised, but monitor for unusual activity.
If you entered a password or verification code: go directly to the real service, change the password, end unfamiliar sessions, and turn on two-step verification. Change other accounts that reused that password. Contact the service through its official support channel if someone may have used a one-time code to sign in.
If you installed an app: disconnect if necessary, remove the app, run the device’s security scan, update the operating system, and review app permissions and accounts.
If you paid or shared card details: contact the payment provider through a known number immediately, monitor transactions, and report the fraud through the appropriate official channel.
For message-based warning signs, use our phishing checklist.
Frequently asked questions
Are all shortened URLs dangerous?
No, but they hide information you need for a safety decision. For login or payment, use the organization’s known app or site instead.
Does HTTPS prove a QR destination is safe?
No. HTTPS encrypts the connection; a scammer can also encrypt a fake website.
Can a QR code itself steal money?
The risk usually comes from the destination or action it triggers—such as a fake payment page, malicious download, or stolen sign-in—not from the printed pattern alone.
Comments
Post a Comment