Is this QR code safe to scan?

QR codes can hide a scam link as easily as a real one. Here is how QR phishing works, the warning signs and how to see where a code goes before you open it.

Last updated September 21, 2026

A QR code is just a link you can’t read. That is what makes it convenient and it is exactly what makes it useful to scammers. You would think twice about typing in parkmeter-pay.xyz, but a square of dots on a parking meter gives you no chance to.

How QR scams work

Stickers on top of real codes. The most common version. A scammer prints codes that lead to a convincing copy of a parking or charging payment page and sticks them over the real ones. You scan, pay and your card details go to someone else.

Codes in emails and letters. A message says your account needs verifying or a parcel is waiting, with a code to scan. Putting the link in a picture gets it past email filters that check links and moves you from a computer to a phone, where the address bar is small and easy to ignore.

Codes that do more than open a page. A code can also join a WiFi network, start a text message to a premium number or offer an app to download. Each needs your confirmation on a modern phone, but a hurried tap is exactly what scammers count on.

Consumer protection agencies, including the US Federal Trade Commission, now warn about these scams specifically.

What to look at before you open anything

The website name is what matters, not the look of the page. Read the part of the address just before the first single slash. For https://pay.citypark.example.com/meter, the site is citypark.example.com. Watch for:

• Text before an @ sign. In http://paypal.com@203.0.113.9/login, everything before the @ is ignored by the browser. The real destination is the number after it.
• A bare number instead of a name. Legitimate businesses almost never send customers to an IP address.
• Lookalike letters. Addresses can use characters from other alphabets that look identical to Latin ones.
• Link shorteners. bit.ly and similar services hide the real destination completely.
• http instead of https. Never enter a password or card number on an unencrypted page.

The QR code scanner shows the full address, names the site it leads to and flags each of these automatically. It works on a screenshot or photo as well as with the camera, so you can check a code from an email without opening anything.

Habits that help

Pay through the operator’s own app or website rather than a code on a sign. Feel the code on a meter or poster: a sticker on top of the printed one is a warning sign. Never scan a code in a message you weren’t expecting. And when a page asks for a password, type the site’s address yourself instead.

For codes you make yourself, a static code with your own address in it, as explained in do QR codes expire, is easier for people to trust because the destination is visible when they check it.

For a related next step see Why is my QR code blurry or not scanning?.