How can you tell if a QR code is a scam?
Short answer
You can tell a QR code is a scam by checking the physical label for tampering, previewing the destination URL before opening it, and evaluating what the webpage asks you to do. Fraudulent QR codes often hide behind physical stickers pasted over legitimate codes, route through shortened or misspelled links, and lead to phishing forms that demand urgent payments or login credentials.
The details
Physical tampering is one of the most common signs of a fraudulent QR code. Attackers frequently place adhesive stickers with malicious codes over legitimate displays on parking meters, restaurant menus, or public transit posters. When you point your camera at a code, always examine the URL preview before tapping it. Look for domain names with suspicious misspellings, strange top-level domains, or untrusted shortened links designed to hide where you will actually land. If the web address looks unusual, you can evaluate the link using our suspicious URL analyzer.
The content of the landing page also reveals scam attempts. As outlined by CISA and the FTC, phishing operations rely on urgent emotional language, claiming immediate account suspension, billing problems, or exclusive prizes. Genuine services rarely require you to enter account passwords or sensitive financial data immediately after scanning a physical code. If a QR code prompts you to download an unsolicited application or enter banking information to complete an everyday task, close the browser immediately and navigate to the verified website directly.
What to do
- Inspect the physical code to see if a sticker was pasted over the original signage.
- Preview the destination URL on your phone screen before tapping to open it.
- Verify that the domain matches the official website and contains no spelling tricks.
- Avoid entering passwords, financial details, or personal data on pages reached via QR codes.
- Type the known official web address manually into your browser if you suspect fraud.
Useful next reads and tools
- Suspicious URL Analyzer · tool
Terms explained
- HTTPS and TLS
- HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.
- Phishing
- Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.