How to Check if a QR Code Is Safe

The problem is that codes are opaque

A QR code is a machine-readable string. To a human it is a pattern of squares that carries no information whatsoever about where it leads.

A phishing link and a legitimate one produce codes that look equally arbitrary. There is no visual cue, no equivalent of hovering over a hyperlink to see the destination in a status bar.

Compounding this, most camera apps decode and immediately offer to open the destination, sometimes with the URL truncated to fit. The decision point arrives after the decoding rather than before it, and by then the momentum is towards tapping.

How the scam actually works

The common physical version is a sticker. A printed code on a parking meter, a restaurant table, an electric vehicle charger, or a public transport poster is covered with a replacement that leads to a convincing payment page.

The digital versions are email and messaging based. A code in an email bypasses the link scanning most mail security relies on, because there is no link for it to scan — just an image. This has a name, quishing, and it exists specifically because the security tooling has a blind spot there.

Package delivery notices, unexpected invoices, and account verification requests are the usual framing, for the same reason they always are: they create a reason to act quickly.

Decode to text before you visit

The whole defence is separating the decode from the visit. Read the code into plain text, look at what it says, then decide.

For a code on a screen, screenshot it and decode the image. For a physical code, photograph it and decode the photo. Either way you end up reading a URL rather than following one.

This costs about fifteen seconds and removes the entire class of attack that depends on you not knowing where you are going.

What to look at in the decoded URL

Read the domain, not the path. Everything after the first single slash is chosen by whoever made the link and proves nothing.

• Does the domain match the organisation the code claims to represent? A council parking code that leads to a domain you have never heard of is a red flag on its own.
• Is it a URL shortener? Shorteners hide the real destination and legitimate organisations rarely need one on printed material.
• Look for lookalike spellings — a zero for an o, an rn for an m, an extra hyphen, or the real brand name appearing as a subdomain of something else.
• Check the top-level domain. A well-known company on an unexpected country suffix is worth pausing on.
• Is it asking for a payment or a login? Those are the two destinations worth the most scrutiny.

Physical codes deserve a physical check

Before decoding anything, look at the code itself. A sticker over a printed code is usually visible — a raised edge, a slight misalignment, a different paper finish, a code that covers part of the surrounding design.

Codes on parking meters and chargers are the most targeted, because payment is expected there and people are in a hurry.

If the surface looks tampered with, do not scan it at all. Use the official app or the phone number printed on the machine instead.

Codes that are not links

QR codes can carry plain text, WiFi credentials, contact cards, calendar events, phone numbers, and payment strings. Not everything is a URL, and each type has its own consideration.

A WiFi code joins you to a network, which is worth thinking about in a public place. A contact card writes an entry to your address book. A phone number code can dial a premium-rate line. A payment code can be pre-filled with an amount and a recipient.

Decoding to text shows you which type you are dealing with before your phone acts on it, which is exactly the point.

Practical habits

Treat a code in an unsolicited email or message the way you would treat a link in one: with suspicion, and by navigating to the organisation yourself rather than through what you were sent.

Prefer typing a known address over scanning, whenever a code is offering a shortcut to something you could reach directly. Restaurant menus are low risk; payment pages are not.

If you have scanned something and are unsure, do not enter credentials or card details on the page it opened. Close it and go to the organisation's site independently. Nothing is lost by arriving the slow way.

Decoding safely

A decoder that runs on your own device and shows you text rather than opening a browser is the safest form of this check. Nothing is transmitted, nothing is opened, and you see the payload as a string.

That matters for codes carrying tickets, payment links, or authentication tokens, where the content is sensitive independent of whether it is malicious.

The habit worth building is small: decode first, read the domain, then decide. It is the same instinct as checking a link before clicking, applied to a format that was designed to make checking hard.

Frequently asked questions