QR Code Scams, and How to Scan Safely

22 September 2026 · updated 13 October 2026 · Free QR Pro

Scanning a QR code does not, by itself, do anything to your phone. A code holds a short piece of text, usually a web address. The risk starts when you open that address, because a page reached through a code can ask for card details or a password just like a page reached any other way. The difference is that you cannot see where a code leads before you scan it.

Where fake codes turn up

The US Federal Trade Commission has warned about several patterns:

• Stickers over real codes. In its December 2023 alert the FTC described scammers covering the QR codes on parking meters with codes of their own, leading to a payment page they control.
• Unexpected messages. Codes sent by email or text message with a made-up reason to act immediately. The December 2023 alert lists a package that could not be delivered, a problem with your account, and suspicious activity that means you must change your password.
• Unexpected packages. In January 2025 the FTC described parcels arriving with no sender and a note inviting you to scan a code "to find out who sent it". The code leads to a phishing site, or tries to get you to install something.

The common thread is a request that feels urgent, and usually a payment or a login at the end of it.

Check the address before you open it

1. Read the domain. Phone cameras show the address before opening it. Check the part just before the first single slash: the domain is what matters, not the words that follow it. Look for misspellings and for a familiar brand name tacked onto an unfamiliar domain.
2. Treat short links with care. A shortened address hides the real destination. That is fine from a source you trust, and a reason to stop from one you do not.
3. Do not pay or log in through a surprise code. If a code on a meter, poster or letter asks for payment or a password, open the official app, or type the organisation's address yourself.
4. Touch the code. On a meter or a poster, a sticker applied over the original is often slightly raised, crooked, or a different size from its frame.
5. Keep your phone updated and use multi-factor authentication on important accounts, so a stolen password alone is not enough.

If you have already entered a password on a page you now doubt, the FTC's January 2025 alert says to change it straight away, use a strong, unique password with two-factor authentication, and, in the US, check your free credit reports for accounts you did not open.

Codes that are not links

A QR code can also hold instructions: join a WiFi network, add a contact, start a text message or a phone call. Most of these ask you to confirm first, but join this network deserves the same care as a link. Joining an unknown network from a code in a public place puts your traffic on someone else's router.

Checking a code without opening it

Sometimes the safest move is to see what a code contains without anything opening at all. This site's QR scanner decodes the image in your browser and shows the full text. Nothing opens until you press Open, and links open in a new tab. It works on a photo or a screenshot too, so you can check a code from a letter or an email on your computer before your phone gets anywhere near it. Scanning from a screenshot explains how.

If you print QR codes, make them hard to fake

• Print your address under the code, so people can check that what their camera shows matches what you meant.
• Point codes at your own domain. A redirect from a third-party service is an address your customers cannot check. It also means someone else controls where every printed copy leads: if that account is breached, or the subscription lapses, the destination changes without the print changing. A static code goes where it was printed to go. Static and dynamic codes, compared.
• Check public codes regularly for stickers, and put them behind glass or lamination where you can.
• Do not make a code the only way to pay. Offer an alternative, so customers never have to trust a code they cannot verify.