What should you look out for before scanning a QR code?
QR codes have become invisible infrastructure: on parking meters, menus, parcels, invoices, and posters. That convenience also makes them a perfect disguise. Criminals know that most of us scan first and think later — which is why we now see QR codes used in phishing emails, fake parking scams, and even unsolicited packages that arrive in the post. The safest approach is to treat every QR code as a link you haven’t seen yet and check a few simple warning signs before you point your camera at it.
💡 Short answer
Before you scan a QR code, check three things: the context, the code, and the link. Ask yourself: does it make sense that a QR code is being used here, and do you trust whoever placed it? Look closely for signs of tampering (stickers over printed codes, blurred or misaligned graphics), and be wary of codes in emails, texts, or unsolicited letters that pressure you to act quickly or pay a bill. After scanning, inspect the URL preview: does the domain look right, is it using HTTPS, and does it clearly belong to the organisation it claims to be? If a scan leads straight to a login, payment page, or download you weren’t expecting, close it and navigate to the site manually instead.
Key things to check before you scan a QR code
- 1. Does the QR code make sense in this context? A QR code on official signage, packaging, or a business’s own materials is lower risk than a random sticker on a lamppost or a code in a surprise text. Be extra cautious if the code appears in an unusual place, asks you to resolve an urgent problem, or appears on parking meters or bills where scams are common.
- 2. Has the code been tampered with? Look for signs of a sticker placed over a printed code, misaligned or low-quality printing, or codes stuck on top of official posters and meters. Law enforcement and consumer agencies have repeatedly warned about fake QR stickers on parking machines, tickets, and shop counters.
- 3. Who is really asking you to scan? Treat QR codes in unsolicited emails, texts, leaflets, or parcels the same way you treat links in phishing messages. If a “bank”, “delivery company”, or “government office” wants you to scan a code out of the blue, don’t – go to their official website or app instead.
- 4. What does the URL preview show? After you scan, your phone should show a banner with the destination. Check the domain name carefully: does it spell the brand correctly, use HTTPS, and avoid random strings or unrelated words? If anything looks off, simply don’t tap.
- 5. Is it asking for sensitive information or installs? If a QR journey quickly asks for passwords, card details, one-time codes, or to install an app from outside an official store, stop. Close the page and navigate manually to the service if you genuinely need to log in or pay.
A simple checklist for safer QR scanning
- Scan only when you understand the source. Ask: “Who put this code here, and what are they trying to get me to do?” If you can’t answer that, don’t scan.
- Inspect the code and surroundings. Look for stickers, overlapping codes, or anything that looks out of place or cheaply added to official signage.
- Use your phone’s built-in scanner. Stick to the camera app or a reputable, ad-free reader. Avoid random scanner apps that demand excessive permissions.
- Read the URL before you tap. Check the domain, spelling, and HTTPS lock icon. If the address is shortened or unfamiliar, consider typing the official site into your browser instead.
- Never rush payments or logins from a scan. If a code claims you must pay a fine, update an account, or “verify” something urgently, treat it as suspicious. Access your account via the official app or website instead.
- Keep your device updated. Current browser and OS security features can sometimes block malicious sites or downloads, giving you an extra safety net.
FAQs
Is it safe to scan QR codes on restaurant menus and shop posters?−
Most of the time, QR codes on clearly branded menus, posters, and packaging are benign. The risk increases when codes are easy to tamper with — for example, small stickers on tables or meters that can be swapped. A quick visual check and a glance at the URL preview will catch most problems. If you’re unsure, ask staff to confirm the correct web address or provide an alternative way to order or pay.
What are the biggest red flags after I scan?+
Major warning signs include: a page that immediately demands login or card details; a site that looks nothing like the brand it claims to be; strange or misspelled domains; prompts to install apps from outside the official app store; and any page that pressures you to act within minutes. Close the tab and access the service by typing its official address instead.
Are QR codes in emails or letters always dangerous?+
Not always, but they deserve extra suspicion. Security agencies have reported rising “quishing” attacks where QR codes in emails or physical mail lead to phishing pages or malware downloads. If a message asks you to scan a code to fix an account, claim a refund, or pay a bill, ignore the code and contact the organisation through its official website or phone number.
Can scanning a QR code put malware on my phone immediately?+
Simply pointing your camera at a QR code typically just opens a link; malware usually still needs an extra step, such as installing an app or downloading a file and granting it permissions. If you avoid installing unknown apps, refuse suspicious downloads, and only use official app stores, you dramatically reduce this risk.
What should I do if I think I scanned a malicious QR code?+
If you entered any passwords or card details, change them immediately from a trusted device and enable multi-factor authentication where possible. Contact your bank if you shared payment information or see suspicious transactions. Running a security scan and updating your phone’s software is also a good idea, and you may wish to report the incident to your national cyber security or consumer protection body.
Talk to an Xcan It Specialist
Rolling out QR codes for customers or staff and want to keep journeys safe without adding friction? We’ll help you design QR flows that are secure, understandable, and easy to manage.
