A QR code is a link: check the destination before signing in
Preview a QR destination, look for replaced physical labels and verify payment or account requests through an independent route.
In brief
Scanning a QR code usually decodes text or a link. The camera does not certify the website, and a sticker placed over a genuine code can send you to an attacker’s page.
Previewing the destination is especially useful for parking, menus, parcel messages and unexpected account-verification instructions.
Read the destination before opening it
A QR image may contain a URL, plain text or other data. Decoding shows that content; it does not verify who placed the code. On a phone, inspect the preview rather than automatically following it. If the preview hides most of the address, use a trusted route to the service instead.
A physical label can be replaced just as an email can be forged. For a parking payment, for example, check the operator’s name and use its known app or the address printed independently on the machine when something is inconsistent.
Separate the hostname from familiar words
Consider the illustrative address https://bank.example.net/login. Its hostname is bank.example.net; the word “bank” alone does not establish a banking relationship. The example.net domain is used here only as an example. A service name in the path or in a misleading subdomain is not proof that the address belongs to that service.
HTTPS protects the connection to the domain you reached; it does not guarantee that the business is genuine. A short link can conceal a later destination, so a preview may not settle the question.
If the code asks you to sign in or pay
Stop and open the organisation’s app or type an address you already know. Find the request there or contact the organisation through an independently verified channel. The FTC warns about unexpected QR messages that use urgency and stories about deliveries or account trouble. Do not treat the code’s polished appearance as evidence of authenticity.
Documentation for these steps: FTC — Scammers hide harmful links in QR codes ↗
If you already followed it
Opening an address, entering a password and approving a payment are different events. If you only opened it, leave the page and review any downloads or permissions you accepted. If you supplied credentials, change them through the genuine service and review sessions and recovery settings. If you paid or disclosed payment information, contact the provider through its official channel. Describe what actually happened rather than assuming every scan means the phone is infected.
For a closer look at the address, use the guide that explains the hostname and the rest of a URL. Read a URL by its hostname, not the most familiar word in it
Tools for this task
Before you act
A legitimate-looking HTTPS address can still be a phishing site. Do not install an unknown scanner or app because the opened page says it is required.
What to do next
- Inspect a physical code for an added sticker or unexpected placement.
- Preview the destination and read its real hostname before opening.
- For money or login, use the service’s official app or a known address instead of relying on the code.
