To check if a QR code is safe, look at where it is placed, make sure it is not a sticker covering another code, and read the link preview before opening it. Confirm the domain belongs to the organisation you expect, and never enter passwords or pay unless everything matches.
Most QR codes you meet are perfectly fine. But because a QR code hides its link, a few seconds of checking can save you from a fake login page or a payment to the wrong person. Here are ten practical checks, grouped into what to look at before, during and after scanning.
Before you scan: look at the code itself
The first clues are physical. Scammers often work by sticking their own code over a genuine one, so start with what you can see and touch.
1. Check whether it is a sticker on top of another code
Run your finger over the code. A raised edge, a slightly different colour or a code that looks newer than the poster around it are all signs it may have been added later. This is especially common on parking meters, EV chargers, bike rental stands and payment signs.
2. Ask whether the location makes sense
A QR code on a restaurant table that opens a menu is normal. A QR code taped to a lamppost promising free money is not. Think about who would have put the code there and whether they would really need you to scan it.
3. Look for branding and contact details
Genuine codes are usually printed as part of a sign, with the business name, logo and sometimes a short web address nearby. A lonely code with no context, or one on a cheap printout, deserves more caution.
While you scan: read the preview carefully
When you point your camera at a code, your phone shows a preview of the link before opening it. This is your most important safety moment.
4. Read the domain name
Focus on the main part of the web address, the bit just before the first single slash, such as example.com. Is it the organisation's real website? Watch for small misspellings, extra words or unusual endings designed to look similar to a real brand.
5. Be careful with shortened links
Short links are common and often legitimate, but they hide the final destination. If the preview shows a short link you do not recognise, use a tool that reveals where it leads. Our guide on whether short links are safe explains how to preview them.
6. Watch for unexpected actions
QR codes can do more than open websites. They can start a phone call, write a text message, add a contact or connect to Wi-Fi. If the preview shows an action you did not expect, such as sending an SMS to a premium number, cancel it.
After it opens: check before you act
Even if the link looks fine, keep your guard up once the page loads.
7. Do not enter passwords from an unknown code
A parking payment page or restaurant menu should not need your email password or banking login. If a page you reached by QR code asks you to sign in, close it and open the official app or website yourself instead.
8. Refuse unexpected app downloads
Be wary if a code pushes you to install an app, especially from outside the official app store or with a request for wide permissions. Install apps only from the store and only when you went looking for them.
9. Confirm the receiver name before paying
When a QR code opens a payment in your banking or e-wallet app, the app shows who will receive the money. Make sure that name matches the shop, person or organisation you intend to pay. If it does not, stop and ask. Our guide to QR payment safety covers this in more detail.
10. Notice pressure and urgency
Scam pages often push you to act fast: pay a fine today, confirm your account now, claim a prize in ten minutes. Real organisations rarely demand instant action through a QR code. Urgency is a reason to slow down.
Quick checklist to remember
If you only remember a few things, make it these:
- Touch the code: is it a sticker over something else?
- Read the domain: is it the real organisation?
- Never log in from a page you reached by an unknown QR code
- Check the receiver name before any payment
- When in doubt, type the website address yourself
Tools that help you check a QR code
Your own judgement is the main defence, but a few tools make checking easier:
- A scanner that previews safely. The QR-TH tool lets you scan a QR code online from your camera or an image. It reads the code in your browser and shows the destination before anything opens.
- Link reputation checks. Services such as Google Safe Browsing keep lists of known dangerous sites. QR-TH checks every link created on the platform against it and re-checks links nightly, and its loading page shows visitors where a link goes before opening it.
- Your browser's built-in warnings. Modern mobile browsers warn you about known phishing sites. Do not click past those warnings.
- Two-step sign-in. If a password does leak, an authenticator app stops most attackers from getting into your account.
No tool can catch every brand-new scam page, so treat these as a safety net rather than a guarantee.
What to do if a QR code seems unsafe
If something feels wrong, do not scan or close the page straight away. Then:
- Tell the business, venue or property manager so they can remove a fake code.
- If you entered a password, change it on the real website at once.
- If you shared card or bank details, contact your bank using the number on your card.
- Report losses to the police or your local consumer-protection authority.
For a full recovery plan, see what to do after scanning a malicious QR code.
FAQ
Can I check a QR code without opening the link?
Yes. Your phone camera shows a link preview before opening it, and an online scanner can decode the code from a photo or screenshot and display the destination without visiting it.
Is a QR code safe if it shows a padlock?
Not necessarily. The padlock means the connection is encrypted, not that the website is honest. Scam sites can have a padlock too, so always check the domain name itself.
Are QR codes from well-known shops always safe?
Usually, but a fake sticker can be placed on any sign, even in a trusted shop. Check for overlays and confirm the receiver name when paying.
What is the safest way to deal with a QR code I do not trust?
Do not scan it. Visit the organisation's official website or app directly, or ask staff to confirm the correct code.
Safe scanning is mostly about habit: touch, read, confirm. Next time a code makes you hesitate, run it through the QR-TH online QR scanner and see exactly where it leads before you decide.