A QR code is just a picture of some text, usually a web address. That is what makes QR codes so convenient, and it is also why they can be misused: you cannot tell where a code leads just by looking at it. Scammers take advantage of this by sticking fake codes over real ones or sending codes in emails and letters. QR-based phishing is sometimes called "quishing," and U.S. agencies including the FBI and the FTC have published consumer warnings about tampered QR codes.
The good news: scanning a code is not the risky step. The risk comes from what you do next, such as opening a fake website and typing a password or card number. A few quick checks catch most problems.
1. Look at the code itself
Before you scan, take two seconds to look at the physical code.
- Is it a sticker on top of something? A code stuck over another code, or over a printed sign, is a classic sign of tampering. Run a finger over the edge if you can.
- Does it look out of place? A crooked label, a different print quality or a code with no logo or explanation on an official sign deserves suspicion.
- Is it in a high-value spot? Parking meters, EV chargers, payment terminals and transit machines are common targets, because people expect to pay there.
If something looks off, skip the code and use the official app or website instead.
2. Ask whether the code makes sense
Context is one of the best safety checks.
- A menu code on your restaurant table makes sense. A code on a random flyer promising a prize does not.
- A letter or email saying "scan to avoid a fine," "scan to fix your account" or "scan to reschedule a delivery" is a common scam pattern. Real organizations rarely ask you to fix an urgent problem through a QR code.
- Urgency, threats and too-good-to-be-true offers are red flags, whether they arrive as a link or a code.
When in doubt, contact the company through a phone number or website you already know, not one from the message.
Make a free QR code for a link, WiFi or contact card — generated in your browser.
Open the free QR code generator →3. Read the link preview before you tap
Most phone cameras do not open a link automatically. They show a preview of the address first. That preview is your best tool.
Look for the real domain: usually the last two parts of the name just before the first single slash (paypal.com in www.paypal.com). For example:
| Address in the preview | Real domain |
|---|---|
| https://www.paypal.com/myaccount | paypal.com |
| https://paypal.com.account-check.net/login | account-check.net |
| https://parking-cityname.pay-now.top | pay-now.top |
In the second example, "paypal.com" appears at the start, but the real domain is account-check.net. Scammers rely on people reading only the beginning.
4. Watch for lookalike spellings
Fake domains often swap characters that look similar at a glance:
- rn in place of m (rnicrosoft instead of microsoft)
- 0 (zero) in place of o, or 1 in place of l
- Extra words or hyphens, like the brand name plus "-support," "-secure" or "-verify"
- An unusual ending in place of the expected .com, .org or .gov
A padlock or "https" only means the connection is encrypted. It does not prove the site is genuine, because scam sites can use https too.
5. Be careful with short links
Short links (such as bit.ly addresses) hide the final destination, so the preview cannot tell you much. Plenty of honest businesses use them, but on a code in a public place or an unexpected message, a short link deserves extra caution. If the page that opens asks you to log in or pay, close it and go to the official site directly.