Treat a QR code as a concealed link. Before opening it, check who placed it, inspect for a sticker covering the original, preview the destination, and verify any request for sign-in, payment, account changes, or app installation through a known website or phone number. If the code arrived unexpectedly or creates urgency, do not scan it.
Check the context before the camera
Ask what the code is supposed to do and whether a trusted organization normally uses it there. A code on a parking meter, package, poster, invoice, text, or email can be replaced or copied. Look for peeling edges, mismatched branding, a second sticker, damage around the code, or instructions added to an existing sign. Physical neatness is not proof of legitimacy.
The FTC's QR-code scam warning describes fake codes placed over parking-meter codes and unexpected codes sent by email or text. It advises inspecting the URL and using a phone number or website already known to be real when a message may be legitimate.
Do not scan a code simply to discover why an unsolicited package arrived or why an account supposedly needs urgent action. The FBI's unsolicited-package alert warns that package-based QR codes can lead people to provide personal or financial information or download malicious software.
Preview and inspect the destination
Use the phone's built-in camera or trusted scanner that previews the destination before opening it. Read the full domain, not just the familiar words at the beginning. Look for misspellings, extra words, an unfamiliar ending, misleading subdomains, or a shortened address that hides the destination. Cancel if the preview cannot be understood.
A padlock or HTTPS connection protects the connection to a site; it does not prove that the site belongs to the organization shown on the sticker. For payments, account access, delivery changes, fines, or benefits, close the preview and open the organization's official app or manually enter a known address. Compare the request there.
Never install an app, configuration profile, certificate, or device-management setting because a public code told you to. Use the official app store reached independently and confirm the publisher and permissions.
Pause at requests for secrets or money
Stop if the page asks for a password, multifactor code, payment card, bank login, Social Security number, crypto payment, gift card, or remote access. Contact the organization through a trusted channel and ask whether the request and amount are real. Urgency, threats, or a claim that only the QR route will work are warning signs.
For a restaurant menu or event ticket, still review the domain before proceeding and limit the information you provide. A low-stakes context can be used to collect more data than the task requires. Keep the phone operating system and browser updated, and use multifactor authentication on important accounts.
Respond after a suspicious scan
If you scanned but did not open the destination, close the preview. If you opened the page but entered nothing, close it, clear any download, and check for a newly installed app or profile. If you entered credentials, go to the real service from a trusted device, change the password, revoke unfamiliar sessions, and review recovery methods and multifactor settings. Change reused passwords on other accounts.
If you provided payment or financial information, contact the card issuer or financial institution using the number on the card or an official statement. Preserve the code, URL, receipt, message, and transaction details for reporting. If an app or profile was installed, disconnect the device from sensitive activity and use trusted platform or security support.
The FBI's QR-code tampering advisory describes malicious destinations used to steal data, install malware, or redirect payments. Report scams through the appropriate provider, payment service, local authority, FTC, or FBI channel based on what occurred.
Use a repeatable decision
Before every scan, ask: Was the code expected? Is its physical placement credible? Can I preview and recognize the destination? Can I complete the task through an official app or typed address instead? Does it request secrets, money, or device changes?
A safe QR workflow adds only a few seconds. The goal is not to avoid every code; it is to expose the hidden destination before the code turns a routine action into an irreversible sign-in or payment.
Sources
- Scammers hide harmful links in QR codes to steal your information — Federal Trade Commission
- Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes — Federal Bureau of Investigation
- Cybercriminals Tampering with QR Codes to Steal Victim Funds — FBI Internet Crime Complaint Center