QR Code Scam Safety Guide: How to Inspect Links Before You Scan or Pay

Overview

A QR code is not a security signal. It is simply a visual way to encode information, often a website address, contact detail, payment request, or application link. Anyone who can create or replace a code can direct it to a destination that impersonates a legitimate business.

QR phishing, sometimes called a quishing scam, usually depends on the same techniques as other phishing scams. The message creates urgency, the destination imitates a trusted service, and the victim is asked to enter a password, card number, bank details, verification code, or other sensitive information. A malicious QR code may also lead to a download or a page that asks you to call fake customer support.

The safest habit is to treat the code as an untrusted link until you verify both the destination and the reason for the request. If the QR code is connected to a payment, account warning, delivery problem, workplace request, or support issue, confirm the request through a separate trusted channel before acting.

For broader link checks, see How to Check if a Link Is a Scam Before You Click and the URL and Website Verification Checklist.

Checklist by scenario

Before scanning any QR code

• Ask why you received it. Be cautious if the code arrived unexpectedly by email, text, social media, a printed notice, or a message claiming that immediate action is required.
• Inspect the physical code. On posters, parking meters, menus, or signs, look for a sticker placed over the original code, mismatched branding, unusual formatting, or a damaged sign. Tampering is not proof of fraud, but it is a reason to stop and verify.
• Prefer the official app or website. If the code is supposed to open a bank, retailer, delivery service, payment provider, or workplace system, navigate there using a bookmark or an address you already trust instead.
• Use the scanner preview. Many phone cameras display the destination before opening it. Read the address rather than tapping automatically.

When the code opens a website

• Read the complete domain. Watch for misspellings, extra words, unfamiliar domain endings, lookalike characters, or a brand name placed in an unrelated domain. The beginning of a long address can be misleading; identify the registered domain near the end of the hostname.
• Do not rely on the padlock alone. HTTPS helps protect the connection, but it does not prove that the website is genuine. Scam sites can also use encrypted connections.
• Check the page’s purpose. A page reached from a restaurant sign should not suddenly request a banking password. A delivery notice should not require unrelated identity details or an unexpected payment method.
• Do not enter credentials from the QR session. Close the page and open the organization’s known app or website independently. If the account shows no matching alert, treat the QR request as suspicious.

When the code requests a payment

• Confirm the recipient and amount before authorizing. Check the payment name, account, invoice, order, or merchant details in the trusted payment application.
• Be wary of pressure. Claims that a payment must be made immediately to avoid a penalty, account closure, arrest, or service interruption are common social-engineering signals.
• Verify changes separately. For invoices, vendor payments, payroll, or account details, contact the known recipient using an established phone number or address. Do not use contact information supplied only beside the QR code. The business payment change verification playbook covers this process in more detail.
• Never approve a payment you did not initiate. If a code appears during an unexpected call or support conversation, end the interaction and contact the provider through its official channel.

When the code is in a workplace

• Confirm that signs, badges, invoices, training materials, and conference displays came from the responsible team.
• Use approved link destinations and centrally managed QR codes where possible.
• Review printed materials after office moves, events, vendor changes, and seasonal campaigns.
• Report suspicious or altered codes to facilities, security, IT, or the document owner rather than removing evidence without recording what you found.

What to double-check

Before you submit information or authorize a transaction, pause for a second verification. Compare the QR destination with the organization’s independently sourced website. Check whether the page uses the expected domain, whether the request matches an action you initiated, and whether the payment recipient is the one you intended.

Look for inconsistencies that a polished page may not hide: an unusual login address, a request for a one-time code, spelling errors, an unfamiliar support number, a different currency, a newly added fee, or a demand to disable security controls. A familiar logo is easy to copy and should not be treated as authentication.

If you are checking a QR code on a phone, do not assume the mobile layout makes the site legitimate. Expand the address bar if necessary, copy the visible domain carefully, and avoid downloading an app or document prompted by an unexpected page. A QR code that leads to an app store listing still deserves scrutiny; confirm that the publisher and app are the expected ones through the organization’s official website.

For messages that accompany a code, evaluate the sender and context separately. The guidance in How to Check a Suspicious Phone Number, Email, or Sender can help with that part of the review.

Common mistakes

• Assuming a QR code is safer than a link. It is another delivery method for a link, not a trust mechanism.
• Checking only the brand name. A page can display a real logo while using a fraudulent domain.
• Entering a password because the page looks professional. Use a known app or bookmarked address for account access.
• Paying from a public sign without checking the recipient. A changed sticker or replacement sign may redirect funds elsewhere.
• Calling the number shown after scanning. Fake support pages may provide a number controlled by the scammer. Find contact details independently.
• Ignoring a successful-looking transaction. Review receipts, account activity, and payment confirmations through the official service, especially if the request was unexpected.
• Waiting after entering information. If you submitted credentials or payment details to a suspicious page, begin response steps promptly. Use the phishing-link recovery plan for a structured checklist.

When to revisit

Revisit this checklist before seasonal planning cycles, major events, office moves, printed-campaign launches, and changes to payment or customer-support workflows. Organizations should review QR destinations whenever a vendor, domain, payment account, app, or sign owner changes. Replace obsolete codes rather than allowing them to point to an abandoned or redirected page.

Consumers should also revisit their habits when installing a new phone, changing payment apps, joining a new workplace, or beginning to use QR codes for parking, deliveries, events, or account access. Scammers adjust their messages and impersonated services, but the core verification process remains stable.

Use this final pause before scanning or paying: What is this code supposed to do? Where does it lead? Is the domain expected? Did I initiate this request? Who receives the payment or information? Can I verify it through a separate trusted channel? If any answer is unclear, do not proceed. Close the page, preserve the message or sign details, and report the suspected QR code scam to the relevant organization or service.