How to Tell If a QR Code Is a Scam: Step-by-Step Inspection

Inspecting QR Codes Before and After You Scan

You can tell if a QR code is a scam by checking the physical code for tampering, inspecting the previewed web address before opening it, and evaluating whether the destination site demands urgent personal or financial details. Quick Response (QR) codes function as optical barcodes that translate patterned squares into text strings, most often web addresses. Fraudulent QR codes direct users to counterfeit websites designed to harvest credentials, intercept payments, or distribute malicious files. Note that specific QR code inspection steps described here derive from widely accepted security industry best practices, alongside established anti-phishing guidance published by government cybersecurity agencies.

When you finish this tutorial, you will have a clear, repeatable method to inspect physical and digital QR codes before interacting with them. You will know how to evaluate destination URLs on your smartphone screen, recognize common social engineering patterns, and protect your accounts if you interact with a deceptive link. Before starting, you only need a smartphone equipped with a native camera application and an active web browser. No specialized software or paid tools are required.

Physical Inspection: Spotting Tampered Stickers and Overlays

Based on widely accepted security practice, criminals frequently target public locations where people expect to make quick transactions. Parking meters, shared mobility stations, outdoor dining tables, and public transit terminals are frequent targets. In these environments, attackers do not need to alter electronic displays. Instead, they print adhesive stickers with malicious codes and apply them directly over legitimate signage.

Run your finger across the surface of the signage before pointing your camera. If you feel a raised edge, a thicker paper layer, or a label covering an underlying graphic, do not scan it. Genuine infrastructure signage is generally printed as a single, uniform panel or protected under transparent acrylic. Look closely at the alignment. Attackers rarely apply replacement stickers with machine precision. If the border of the code is crooked, peeling at the corners, or reveals a different pattern beneath it, assume the code has been altered.

Inspect the surrounding context for official branding discrepancies. Scammers often use low-resolution company logos, inconsistent font choices, or generic instructions like scan here to pay parking fee without listing the municipality or operator name. If a physical code looks modified or suspicious, look for a posted terminal number and pay using the official operator website or dedicated application.

Evaluating the Destination URL Before Opening the Link

Many modern smartphones show a preview banner with the destination URL before opening the link when your camera detects a code. This preview is your primary line of defense. Check your device settings to ensure your phone does not open scanned links automatically in a browser. Instead, examine the text of the link while it remains in preview mode.

Check the top-level domain and the exact spelling of the host organization. Fraudulent operations rely on typosquatting and deceptive subdomains to mimic legitimate enterprises. According to guidance on recognizing phishing from CISA, attackers frequently substitute characters or misspell domain names to deceive users, such as using incorrect addresses like amazan.com, and often employ untrusted shortened URLs to hide malicious destinations. A scammer might display a domain formatted as cityparking-payments.com or use slight variations to confuse visitors.

Be wary of shortened URLs such as bit.ly, tinyurl, or custom redirects that obscure the true destination. Legitimate billing entities and municipal utilities typically direct users to their branded, top-level domains. If you are unsure whether a destination link is genuine, you can copy the raw address and test it with a suspicious URL analyzer, a defensive web tool that safely inspects links for known threat indicators and hidden redirection paths without running untrusted scripts on your device.

Identifying Red Flags on the Landing Page

If you open the link, evaluate the landing page before typing any information. Fraudulent sites are designed to capture sensitive data quickly through emotional pressure. The Federal Trade Commission notes in its phishing guidance that scammers frequently claim urgent billing problems, state that an account is on hold, warn of suspicious activity, or demand confirmation of personal and financial information to prompt compliance.

Look for generic greetings, missing company contact details, and input forms demanding sensitive information. As documented in FTC consumer guidance, legitimate companies will not email or text you with a link requesting that you update payment details. Similarly, legitimate service operators do not deploy public QR codes that require you to submit your Social Security number, banking PIN, or email account password to complete a basic parking or retail transaction. If a site requests comprehensive personal details for a simple service, stop and close the window.

Examine how the site processes payments. Based on widely accepted security practice, a fraudulent portal will often demand direct credit card entry while disabling standard digital wallet options such as Apple Pay or Google Pay. Secure digital wallets use device tokens and authentication checks that make credential harvesting unprofitable for basic phishing infrastructure. If you suspect an attacker has gained access to your profile through a credential prompt, review the 7 signs your account has been hacked to contain unauthorized activity.

Decision Rule: The Safe QR Scan Checklist

Use this standard decision rule whenever you encounter a QR code in public or through unsolicited mail. Apply four sequential checks before trusting the destination. First, inspect the physical integrity of the code. If it is a loose sticker placed over an existing sign or displays peeling edges, reject it immediately. Second, review URL transparency in your camera preview. If the link uses an untrusted URL shortener or shows a raw numeric IP address, cancel the scan. Ensuring the code is part of the original physical signage and reveals its complete address stops most rudimentary attacks before a connection is established.

Third, evaluate domain ownership against the authentic operator. The domain name must match the known, verified website of the organization without hyphenated filler words, extra subdomains, or intentional misspellings. Fourth, check whether the data request is proportional to the service. If a simple parking or dining portal asks for account passwords, social security numbers, or excessive personal profiles, close the session immediately. Applying this four-point checklist prevents social engineering tactics from capturing your information or directing your browser to credential-harvesting pages.

How to Verify That Your Inspection Worked

To verify that your inspection technique is working effectively, run a controlled test on a known, benign QR code. You can use the QR code printed on your home Wi-Fi router, a verified retail receipt, or a trusted package tracking slip. Open your default camera app, align the code within the frame, and ensure the device holds the preview banner without launching the web browser automatically.

Confirm that your browser settings enforce manual confirmation. On modern operating systems, you can check camera settings to confirm that automatic link navigation is disabled. When the banner appears, verify that you can clearly read the protocol, the primary domain name, and the path. If your camera app opens the destination site without your explicit confirmation tap, open your device settings and turn off automatic link launching.

You should also check that your device displays clear security warnings when visiting untrusted web locations. Modern browsers flag expired TLS certificates and known deceptive sites. If your inspection catches a suspicious URL, you have successfully applied defensive validation before exposing your device to risk.

What to Do If You Scanned a Fraudulent QR Code

If you suspect you entered data into a fraudulent website, act immediately to secure your assets. If you submitted a password, navigate to the legitimate service provider using a separate, manually typed browser tab and update your password immediately. CISA recommends using strong passwords and a password manager. Ensure that you implement strong credentials and learn how to turn on MFA for your most important accounts so stolen passwords alone cannot grant access to your profiles.

If you entered credit card details, contact your bank or card issuer immediately using the customer service number on the back of your physical card. Request a block on the compromised card number and ask for a replacement card with a new security code. If you revealed your Social Security number or comprehensive identity records, report the incident through IdentityTheft.gov to establish a formal recovery plan as advised by the FTC.

Help protect others by reporting the fraudulent infrastructure. If you encountered a suspicious link in an unsolicited message or paper delivery scam, similar to patterns covered in delivery text scams, file a report with the Federal Trade Commission at ReportFraud.ftc.gov. You can also alert the facility manager or local parking authority so staff can remove fraudulent physical stickers from public hardware.