The quick answer: read the address before you open anything
A QR code is a link you cannot read, stuck on a parking meter or printed on a flyer. Scanning it only reads some text. The risk starts when your phone or you act on that text: opening a page, joining a network, paying or installing. Read it first with the QR code scanner, which shows what the code holds and flags the usual tricks in a link, without opening it.
- Look at the code where it is. Is it a sticker on top of the sign, or printed into it? Run a fingertip over the edges.
- Scan it with the QR code scanner: choose With the camera and press Start the camera, or stay on From a picture and choose a photo of the code. Nothing opens by itself.
- Read the full address, with the host name set in bold, and any warnings under it.
- Open it only if the site is the one you expect. For a bank, a shopping account or anything with a password, type the site's address yourself instead.
What can go wrong with a code you did not make
A code is only as trustworthy as whoever put it there, and printed codes can be covered by a sticker with a different one. What matters is what the code asks your phone to do:
| The code holds | What can go wrong | What the scanner shows |
|---|---|---|
| A web link | A look-alike page that asks you to log in or pay | The full address and warnings about the tricks below |
| A payment request | Money goes to whoever made the code, and crypto payments cannot be reversed | A request to pay, with a warning to check the name and amount in your own app |
| A Wi-Fi network | An open network means others nearby may read what you send | The network name, hidden password and an open-network warning |
| Login app setup | The code holds a secret key, so anyone with a picture can make your login codes | A clear warning not to share it or post it |
| Contact, email, text | Prefilled details, but you still press save or send | Who it goes to and what it says |
Tricks hidden in a web address
- A short link. The real destination is hidden until you open it. The scanner flags a list of well-known short link services. A short link from a service it does not know is not flagged.
- Text before an @ sign. In
https://[email protected]/signin, everything before the @ is a user name. The link really goes to login-check.example. The scanner gives this its strongest warning and shows the real host. - Look-alike letters. Some Cyrillic or Greek letters look identical to Latin ones, so an address can seem to name a site you know. The scanner shows how such an address reads in its own letters.
- A familiar name in front. Read a host name from the right, where the site is usually the last two parts. In
bank.example.login-check.examplethe site is login-check.example, and bank.example is only a prefix. The scanner shows the host in bold but does not warn about this, so you have to read it. - http, not https, or an address made of numbers. The first is not encrypted, and honest sites almost always have a name instead of numbers.
- Hidden characters. Zero width characters and text direction marks are shown as codes so they cannot hide in the text.
How to look before you open
The QR code scanner reads a code with your camera or from a picture, names the kind of code and lists its details. A link is shown in full and opens in a new tab only after you click. A code in an email, a screenshot or a saved photo works through scan QR code from image: drop the picture or paste it. If the code arrived inside a PDF, convert the PDF to JPG or take a screenshot first, because the scanner reads pictures, not PDF files.
What the scanner cannot tell you
It reads the text and applies pattern checks. It never visits the link and does not look the site up on any list of bad sites, so a link with no warnings is not a guarantee. It also cannot see a sticker, a look-alike company name or a page that is honest looking and fake. The decision stays with you.
The picture or camera frame is read in your browser and not uploaded, so scanning a suspicious code does not load the page. You can confirm it with the Network tab of your browser's developer tools, the same test described in is it safe to upload a PDF to a free website.
A checklist for a code in a public place
- Is it a sticker? A lifted edge, slightly different paper or a second layer over a printed code deserves doubt. Compare it with the business's own website or ask staff.
- Is it where you would expect? A code on a menu in the restaurant is normal. Fake payment codes stuck over real ones are a known scam, so check the sign and the address before you pay.
- Does the host match the business? Read from the right. A short link or a name you do not recognize is a reason to stop.
- What does the page want? A login, a card number, a one-time code or an app install because a code sent you there is the signal to close the page.
- Did a message pressure you? A code in an unexpected email, letter or text about a missed delivery or a payment is a link from a stranger. Treat it like one.
- Is it a payment request? Check the name and the amount in your own payment app before you confirm.
When to simply not scan
Skip the code when it covers another code, when it arrived unprompted and wants a login or a payment, when it is the only way offered to pay and the sign looks tampered with, or when it asks you to install something. Nothing is lost by walking away: look up the business yourself, or ask staff.
If you already opened a bad code, close the page and do not enter anything. If you typed a password, change it to a new one (make a strong password shows how), and change it anywhere you reuse it. If you paid, contact your bank or payment provider promptly.
Codes you put up yourself
If your own codes hang in public places, check them now and then, because someone can stick a different code over yours. Print the address in words beside the code so people can compare, and make a static code with the QR code generator. Make a QR code that keeps working covers what can break. Shop barcodes are another job: the barcode scanner reads the number and does not look anything up, and make a barcode that scans explains how one is built.