QR Code Safety: How to Check a Code Before You Scan It

A QR code is not a link. It is a picture of a link — or of text, a phone number, or a Wi-Fi password — and your scanner decides what to do with it. That gap between what the code looks like and what it actually contains is exactly what scammers exploit. The good news is that checking a code takes about five seconds, and the habit is easy to build.

What a QR Code Really Contains

A QR code stores a short string of characters. Depending on the format, that string might be:

• A web address — the most common case, and the one used in most scams.
• Plain text — a note, a serial number, a short message.
• A phone number or email address — scanning can start a call or draft a message.
• Wi-Fi credentials — the network name and password, used to join automatically.
• Payment or contact data — a payment handle or a vCard.

Nothing in the code itself tells you whether the destination is legitimate. Anyone can generate a code pointing anywhere in seconds, for free.

The "Quishing" Pattern

The most common QR scam is simple: a sticker with a malicious code is placed over a real one. Parking meters, restaurant tables, electric-vehicle chargers, event posters, and Wi-Fi signs are all frequent targets, because the original code is expected to be there and nobody questions a small square.

Before scanning anything in public, look at the physical sticker. Is it a printed label sitting on top of a laminated sign? Is it crooked, or covering another code? Does the URL printed next to it match what the code opens? A code on a sticker is a code someone could have replaced.

Preview the Link Before Opening It

This is the single highest-value habit: make your scanner show the decoded content and wait for you to confirm. Many system camera apps now display a small link preview — tap it to read the full address before opening.

• Read the domain carefully. Look at the part before the first slash. Misspellings, extra words, and lookalike characters are the standard trick.
• Prefer https, but do not treat it as proof of legitimacy. Encryption protects the connection, not the honesty of the site.
• Watch for shorteners and redirects. A code pointing to a short link hides its destination. If the preview shows one, do not open it — or open it only after confirming the sender.
• Check the path. A legitimate service usually has a short, structured path. Random strings are a warning sign.

Disable auto-open in any scanner app that offers the setting. A scanner that opens links immediately has removed your only chance to check.

Red Flags Specific to Payments

Payment codes deserve extra caution because the loss is immediate and often irreversible.

• A payment page asks for your card number and PIN. Person-to-person payment codes do not work that way. Anyone requesting full card details through a QR-opened page is collecting them.
• Unexpected urgency. "Pay within 10 minutes or your booking is cancelled" is pressure, not process.
• A code from a stranger. Never scan a payment code sent by someone you do not know, no matter how convincing the story.
• Amounts that do not match. Confirm the recipient name and amount on the payment screen before approving, not after.

Wi-Fi and App-Download Codes

Wi-Fi

A Wi-Fi QR code is convenient, but joining a network is a decision about who can observe your traffic. Verify the network name with staff, and avoid open networks for anything sensitive. If you must use one, prefer sites that show a padlock and avoid logging into banking or email.

App downloads

Some codes promise an app but point to an installer file instead of a store listing. Sideloading an APK from a random link is one of the fastest ways to install malware. Install apps only through Google Play, and if a code opens a download prompt, close it.

Choose a Scanner That Shows You the Target

• It should decode and display the content, then require a tap to act.
• It should not request contacts, SMS, or accessibility permissions — a scanner needs the camera and nothing more.
• It should keep a short, visible history so you can review what you scanned.
• If it offers to open links, prefer opening them in a private browser so the session leaves less behind.

If You Already Scanned Something Suspicious

1. Close the page immediately. Do not enter any information, even to "verify" or "cancel".
2. Do not grant permissions or install anything it offers.
3. Clear the tab and, if the site requested notifications, decline and remove the site from your browser's notification settings.
4. If you entered card details, contact your bank and ask them to block or replace the card.
5. If you installed an unknown app, uninstall it, then run a Play Protect scan from the Play Store.

QR codes are genuinely convenient, and the risk is manageable. The whole defence is a pause: look at the sticker, read the decoded address, and only then decide. Five seconds, every time.