On this page
A QR code is a convenient way to carry information, often a website address. Its pattern does not tell you who placed it there or whether the destination is trustworthy. The decision point comes before you enter a password, approve a payment, install an application, or share personal information.
You do not need to become an expert in QR encoding to make that decision. Check the physical or message context, inspect the destination when your device allows it, and verify consequential requests through a route you already trust. If something remains unclear, use another way to complete the task.
Start with why the code is there
A code on a restaurant menu, parking sign, mailed package, or unexpected text arrives with a different context. Ask whether you expected the request and whether the action fits the setting.
For example, a menu should not normally require your banking password. A message claiming a delivery problem should not become trustworthy merely because it presents a QR code instead of a clickable link. Urgency, threatened penalties, or an unexpected demand to authenticate deserve independent checking.
The FTC has described both covered parking-meter codes and unexpected messages that use QR links. A familiar physical location or a recognizable logo therefore provides context, but neither proves who controls the destination.
Inspect the sign or message without treating appearance as proof
On a public sign, look for an added sticker, damaged printing, or inconsistent instructions. Do not peel off labels, damage equipment, or interfere with a payment device. If the code appears altered, use the operator's established alternative and report the location to staff.
In a message, consider the sender and the request together. An account name or familiar display picture can be copied. A message in an existing conversation can also be unexpected if the sender's account was compromised.
Contact a known person through another established channel when a request changes payment details or asks for sensitive access. Do not use a phone number supplied only by the suspicious message as your independent verification route.
Read the destination preview carefully
Many phone camera or scanning interfaces show the destination before opening it. Read the address rather than tapping automatically. Look for misspellings, extra words, or an organization name placed inside an unrelated address.
Long addresses can be difficult to interpret, especially on a narrow screen. If the preview is truncated or hidden behind a short link, do not assume the unseen part is safe. An independent route to the organization is often easier than investigating an opaque redirect chain.
An encrypted connection indicator means the connection to that site is protected in a particular way; it does not establish that the site is the organization you intended. A copied logo and polished page likewise do not settle identity.
Verify the task through a known route
For an account notice, open the organization's app you already use or type its known website address yourself. Check for the same notice inside the account. For a public service or venue, ask staff for the official payment method or use an established signposted alternative.
If a parking provider offers several payment methods, confirm the correct operator and location before paying. Do not infer that every search result using the car park's name is official; advertisements and lookalike sites can complicate that route too.
The phishing email guide covers the same identity problem in another format. The practical question is whether you can verify the request independently of the content asking you to trust it.
Match the requested action to the purpose
Pause if the page asks for more information than the task reasonably needs. A simple information page should not require remote-control software, a device-management profile, or a recovery code. Do not install an application just because a QR landing page insists it is necessary.
If you need an official application, obtain it through the device's trusted app store and verify the developer and app identity using the organization's established information. Store availability is a useful distribution route, not a guarantee that every similarly named app is the one you intended.
For a payment, review the payee, amount, currency, and description in the payment interface before authorizing it. A correct amount does not compensate for the wrong recipient. If any detail differs from the expected transaction, stop and confirm through the provider's known channel.
Do not confuse scanning with every later action
If you scanned a code but did not open the destination, the situation differs from entering a password or approving a transfer. If you opened a page, record what happened next: whether you typed information, downloaded a file, granted permission, or installed anything.
Do not assume that a scan alone proves your phone is compromised, and do not dismiss a consequential action because the page looked normal. The appropriate response depends on the actual exposure and any signs of unwanted activity.
Keep the phone's operating system and browser updated through their normal settings. The smartphone security checklist covers broader maintenance without relying on a special QR-scanning product as a complete defense.
Respond to information or money you already shared
If you entered account credentials on a page you now distrust, use a trusted device and the provider's established security process to change the password and review access. Do not return to the suspect page to ask it to remove your information.
If you approved a payment or provided payment details, contact the relevant bank, card issuer, or payment service promptly through its official route. Explain what happened and ask about the actions available for that specific payment method. Recovery is not guaranteed, and anyone promising recovery for an upfront fee deserves scrutiny.
If you installed software or granted unusual permissions, seek the device provider's or your organization's support guidance. The online scam recognition guide can help organize the warning signs and preserve the relevant details without continuing the interaction.
Leave a useful report
For an altered public code, note the location and time and notify the responsible operator. Preserve a screenshot or photograph only when it is safe and does not expose another person's information. Avoid reposting a live malicious code where other people might scan it.
For a message scam, use the messaging service's reporting function and the appropriate consumer-reporting channel. The useful outcome is a verified route to the real task and a response matched to what actually happened, rather than a blanket belief that all QR codes are safe or all are dangerous.
Sources and further reading
Primary and contextual sources used to verify definitions or give readers a relevant next resource.
- FTC: Harmful links hidden in QR codes Scammers can replace public QR codes or send urgent messages that lead to spoofed pages; the FTC advises checking the URL and contacting organizations independently.
- VA: Understanding QR code fraud The VA describes QR payment and information scams and advises verifying destinations and using trusted app stores for downloads.