- Guide type
- Guide + free tool
- Risk
- Medium
- Time
- 5 min
- Cost
- Free
- Works on
- Phone & computer
- Last verified
- 2026-10-05
The short answer
- A QR code is just a link you cannot read. Before you open it, read the address your camera shows and check it is the real company's domain.
- Be most careful with codes that ask you to pay (parking, fines, invoices) or sign in. Type the official website or use the official app instead.
- Not sure? Upload a photo of the code to the checker below. It decodes the code on your device and shows where it really leads, without opening it.
Where fake QR codes show up
| Place | The trick | What they want |
|---|---|---|
| Parking meters and pay stations | A sticker with a fake code is placed over the real one. The FTC has warned about this specifically. | Your card number |
| Emails ("quishing") | A "security update", shared document or failed payment, with a QR code instead of a link so email filters miss it. | Your work or email password |
| Unexpected parcels | A package you did not order with a note: "scan to see who sent this gift". The FTC warned about this in 2025. | Your logins and card details, or malware on your phone |
| Restaurant tables, posters, flyers | A sticker over the menu or event code leads to a look-alike payment page. | Your card number |
| Texts and social media | "Scan to claim your refund / prize / delivery slot". | Card details, personal information |
Check a QR code without opening it
The image is decoded in your browser and never uploaded. The link is not opened.
The checker flags the patterns scammers rely on: look-alike brand names on someone else's domain, bare IP addresses, hidden characters, unencrypted pages and link shorteners. It cannot prove a site is safe. A brand-new scam site on an ordinary-looking domain will pass, which is why the place you found the code matters as much as the link.
Five checks before you open any QR code
-
Look at the code itself
Is it a sticker on top of a printed sign, slightly crooked, or a different size from the frame around it? On parking meters and restaurant tables, that alone is a reason to walk away. The FBI recommends checking physical codes for tampering.
-
Read the address before you tap
Both iPhone and Android cameras show a preview of the link when they recognise a code. Read the part just before the first single slash: in
https://pay.city-parking.example.com/zone4, that isexample.com, not "city-parking". If you cannot tell whose site it is, do not open it. -
Never pay or sign in through a QR code you did not expect
For parking, use the operator's official app or the website printed on the sign. For bills and fines, type the website you already know. The FBI's advice is to avoid paying through a site reached from a QR code and to type a known, trusted address instead.
-
Don't install apps from a QR code
Get apps only from the App Store or Google Play, searched by name. And use your phone's built-in camera to scan: separate "QR scanner" apps are unnecessary and some are full of ads or worse.
-
Treat QR codes in emails as suspicious by default
Companies almost never need you to scan a code on your phone from an email you are reading on your computer. That handoff is exactly what scammers want: your phone is outside your work's security filters.
Already scanned one and entered details?
| What you entered | Do this now |
|---|---|
| Card number | Call your bank using the number on your card. Ask them to block it and dispute any charge. |
| A password | Change it from another device, starting with your email account, and sign out all sessions. Our guide on what to do after clicking a phishing link walks through it. |
| Installed an app or profile | Delete it, remove any unknown profile (iPhone: Settings › General › VPN & Device Management), and run a Play Protect scan on Android. |
| Nothing, just opened the page | Close it and update your phone. The risk is low. |
Then report it. In the US, use ReportFraud.ftc.gov, or IC3.gov if you lost money. If the fake code was on a parking meter or in a shop, tell the operator or the city so the sticker gets removed before the next person pays.
Don't
- Don't scan codes on unexpected parcels to "find out who sent it".
- Don't trust a code because it is printed on something official-looking. Stickers are cheap.
- Don't use a QR code to join a Wi-Fi network in a public place unless staff confirm it is theirs.
QR scams are one branch of the same family as fake toll and delivery texts and phone calls that imitate relatives. If you run a business, put "never pay from a QR code in an email" into the payment rule in our small business cybersecurity checklist, and share our voice clone scam guide with your family.
How we checked this
Written by Ariel, ICT engineer. On 2026-10-05 we tested the checker in Chrome on Windows 10 with QR images we generated for a normal company website, a shortened link, a look-alike "paypal" address on another domain, an IP address, a Wi-Fi code and a crypto payment request, and confirmed that decoding happens in the browser with no upload. Advice was compared with the FBI's public service announcement on QR codes and the FTC's consumer alerts. The decoder uses the open-source jsQR library (or the browser's own barcode reader when available). This page contains no affiliate links.