Learn how to tell if a QR code is safe before scanning it. Discover 12 QR code scam warning signs and how to check suspicious QR codes.
QR codes are everywhere. You see them on restaurant tables, parking meters, product packaging, event tickets, posters, receipts, emails, and text messages. They make it easy to open a website, view information, or make a payment without typing a long web address.
But there is a problem: a QR code itself does not tell you whether the destination is trustworthy.
Scammers can use QR codes to send people to fake websites, phishing pages, payment scams, or other harmful destinations. The FBI has warned that criminals can tamper with legitimate QR codes or use QR codes to redirect people to malicious websites.
So how can you tell if a QR code is safe before you scan it?
The good news is that you do not have to treat every QR code as dangerous. You just need to slow down and check where it is taking you before you interact with the destination.
A QR code scam happens when someone uses a QR code to send you somewhere you did not expect to go, usually with the goal of stealing information, money, account credentials, or access to your device.
The QR code may appear completely normal.
For example, a scammer might:
The FTC has warned that scammers may use QR codes to direct people to spoofed websites designed to steal personal information.
You do not need to become a cybersecurity expert to spot many QR code scams. Start with these warning signs.
One of the biggest warning signs is simply not knowing why you received or found the QR code.
Be especially careful if a QR code suddenly appears in:
An unexpected QR code does not automatically mean it is a scam, but it is a reason to verify the situation before scanning.
Scammers often want you to act before you have time to think.
A QR code might come with a message saying that you need to scan it immediately to:
The FTC specifically warns about QR-code messages that create urgency and pressure people to scan without thinking.
If the message is designed to make you panic, stop and verify it independently.
This is especially important with physical QR codes.
Scammers have been reported placing their own QR codes over legitimate codes on parking meters and other public locations.
Before scanning a physical QR code, look closely.
Does it appear to be:
If something looks unusual, do not scan it.
Many phones show a link preview when you scan a QR code.
Check that URL before opening it.
Look carefully for:
For example, a scammer might create a domain that looks similar to a legitimate company but changes one letter.
The FBI recommends checking the URL after scanning and looking for typos or misplaced letters.
Suppose you scan a QR code that you believe belongs to a restaurant, but the link opens a completely unrelated website.
Stop.
Do not enter information simply because the page looks professional.
A QR code can redirect you to a destination that has nothing to do with the place where you found it.
Be cautious if the page opened from a QR code immediately asks for information such as:
A QR code does not make a website trustworthy.
If you were not expecting to provide the information, leave the page and verify the request through the organization's official website or another trusted contact method.
Be particularly careful when a QR code suddenly takes you to a payment page.
This can happen in scams involving:
If you need to make a payment, consider navigating to the organization's official website or app yourself rather than relying on a QR code from an unexpected message.
The FBI advises caution when making payments through websites reached from QR codes.
An unexpected package containing a QR code deserves extra caution.
The FBI has warned about scams involving unsolicited packages containing QR codes that may lead people to provide personal or financial information or download malicious software.
If you did not order the package and do not recognize the sender, you do not need to scan the QR code just to find out what it is.
A QR code in a message from an unknown person or account should be treated cautiously.
Even if the message claims to come from a familiar company, do not assume it is genuine.
Instead, find the company's official website independently and check whether the claimed issue is real.
Be careful if scanning a QR code takes you to a page asking you to download an app.
The FBI specifically advises people not to download apps from QR codes and recommends using the official app store instead.
If you need an app, open your phone's official app store and search for it yourself.
Think about what you are being asked to do.
If a company normally lets you log in through its official website or app, but a message suddenly tells you to scan a QR code and enter your password somewhere else, pause.
The safer approach is usually to open the official website or app yourself and check for the issue there.
Sometimes the biggest warning sign is that the story simply does not add up.
Ask yourself:
Why am I being asked to scan this QR code?
If you cannot answer that question clearly, do not scan it yet.
Take a moment to verify the request independently.
No.
A QR code is simply a way of encoding information that your phone can read. The appearance of the code does not prove that the destination is legitimate.
A scammer can create a QR code that looks just like an ordinary QR code.
That is why you should focus on where the QR code takes you, not what the QR code looks like.
Not necessarily.
HTTPS is useful because it helps encrypt the connection between your device and a website, but it does not prove that the website itself is legitimate.
Scammers can use HTTPS on fake websites too.
So if a QR code opens a website with a padlock or HTTPS, still check the domain name and the reason you were sent there.
If you are unsure about a QR code, use this simple process.
Ask why you are being asked to scan it.
Was it expected?
Does it come from a source you trust?
Does the situation make sense?
If it is printed somewhere, check whether another sticker or label appears to have been placed over the original code.
This is particularly important for public payment locations.
After scanning, look at the URL before opening it.
Check for spelling mistakes, strange domains, or a destination that does not match the organization.
Even if the page looks professional, do not immediately enter your password, payment details, or other sensitive information.
Verify the website first.
If a QR code claims there is a problem with your account, package, payment, or booking, visit the organization's official website yourself.
Do not rely on contact information contained in the suspicious message.
If you are unsure about a QR code, you can use a QR code scam checker to inspect it before proceeding.
Try Scamlify's QR Code Scam Checker
It can be useful as an additional check when you are unsure about a QR code or its destination.
However, no automated checker should be treated as a guarantee that something is safe. Use the result together with the context and URL checks above.
QR code scams are not limited to posters and parking meters.
A scammer may send a QR code through an email or text message and create a convincing reason for you to scan it.
For example, you might receive a message claiming:
"Your package could not be delivered."
"Your account needs verification."
"Your payment failed."
"Suspicious activity was detected."
"Your account will be closed."
"Your payment is overdue."
The goal is to make the QR code seem like the quickest way to solve a problem.
If you receive an unexpected QR code by text message, you can also check the message itself before doing anything.
Check a suspicious text with Scamlify's SMS Scam Checker
For suspicious emails containing QR codes, you can use:
Scamlify's Email Scam Checker
You can also inspect the email's routing and authentication details with Scamlify's Email Header Analyzer.
First, do not panic.
Scanning a QR code does not automatically mean your device or accounts have been compromised.
What matters is what happened after you scanned it.
If the QR code opened a suspicious website, close it and do not enter any information.
If you entered a password, change it promptly, especially if you use the same password elsewhere.
If you entered financial information or notice an unfamiliar transaction, contact your bank or card provider through an official channel.
If something downloaded or installed unexpectedly, stop interacting with it and consider getting help from a trusted adult or qualified technical support.
The FTC recommends changing passwords and reviewing financial transactions if you interacted with a malicious QR-code site.
Before scanning a QR code, ask:
If several answers concern you, stop before continuing.
You cannot determine whether a QR code is safe simply by looking at the pattern. Check where it leads, inspect the destination URL, look for suspicious domains or spelling mistakes, and consider whether you expected the QR code in the first place.
Yes. A QR code can direct you to a fake website, phishing page, payment scam, or other harmful destination. The FBI and FTC have both warned consumers about QR-code scams.
Not automatically. Public QR codes can be tampered with or replaced. Before scanning a QR code at a parking meter, restaurant, poster, or other public location, check that it has not been covered or altered.
A QR code itself does not magically steal information. The risk comes from what it directs you to do. A malicious QR code may send you to a fake website designed to collect passwords, financial information, or other sensitive data, or may lead to harmful downloads.
A QR code can direct you to content that may attempt to install malicious software or trick you into downloading something harmful. That is why you should be cautious about unexpected downloads and use your phone's official app store for apps.
It is safer not to scan an unexpected QR code from a text message. If the message claims to be from a company you use, contact that company through its official website or app instead.
Close the suspicious website and do not enter additional information. If you entered a password, change it. If you entered financial information or notice suspicious transactions, contact your bank or card provider through an official channel. Review your accounts for anything unusual.
QR codes are convenient, but convenience should not replace caution.
A QR code can look completely normal and still send you to a suspicious destination. Before you scan one, think about where it came from, inspect the destination URL, watch for unexpected requests for information or payment, and verify important requests through an official website or app.
The most important habit is simple:
Do not trust a QR code just because it looks legitimate. Check where it takes you before you continue.
If you regularly receive suspicious QR codes, messages, or emails, Scamlify can help you check them before you interact with them.