How to Check a QR Code Before You Scan It
A QR code is a square pattern of black and white dots that your phone camera reads like a barcode. Point your camera at one and it opens a web page, starts a payment or downloads an app. That convenience is exactly why scammers like them. You cannot read a QR code with your eyes, so you cannot tell where it leads until you scan it.
This article explains how the common tricks work, then gives you steps to check a code before you act on it.
How QR code scams work
The idea is simple. A criminal makes a code that leads to a web page they control, then puts it where people expect a code to be trustworthy.
Parking meters and pay stations. Someone sticks a fake code over the real one on a meter or sign. You scan it expecting to pay for parking, land on a page that looks official, and type in your card details. The money and the card number go to the scammer, not the city or the parking company.
Flyers and posters. A flyer on a telephone pole, a coffee shop notice board or a windshield offers a discount, a job or a free giveaway. The code leads to a page that asks for your login, your phone number or your payment details.
Emails. A message claims to be from your bank, a delivery company or your own IT department, and includes a code to scan. The reason scammers use a code instead of a normal link is that email security tools can often spot a suspicious link in the text, but they have a harder time reading what is inside a picture.
The scam page usually does one of three things: asks you to log in (so they steal your password), asks you to pay (so they steal your card), or pushes you to install an app (which may be harmful software, often called malware).
Check a code before you scan it
Take a few seconds with these steps. They cost nothing and catch most problems.
- Look at the code itself. If it is a sticker, run your finger over the edge. A code stuck on top of another one may feel raised or peel at the corner. On a meter or sign, check whether it looks like part of the original or like a label added later.
- Ask whether you expected it. A code in an email you did not ask for, or a flyer offering something too good to be true, deserves suspicion. If a message claims to be from a company, do not scan its code. Open the company's website yourself by typing the address, or call a number you already trust.
- Preview the address before opening it. Both iPhone and Android cameras show a small banner with the web address when you point at a code. Read it, but do not tap it yet. Watch for misspellings, extra words, strange endings, or an address that has nothing to do with the business. A parking payment code that leads to a random address is a red flag.
- Be careful with shortened addresses. Some codes use a shortened web address that hides the real destination. If you cannot tell where it goes, do not continue.
- Use the official route instead. For parking, use the app or website named on the official signage, or pay at the machine with the card slot. You lose nothing by skipping the code.
Checking a code on a Windows PC or Mac
Sometimes the code arrives in an email or a document on your computer. You can still check it without trusting it.
On either computer, the simplest approach is to use your phone's camera to point at the code on the screen, read the address in the banner, and stop there. Do not tap through if the address looks wrong.
If you would rather not use the phone, save the image of the code to your desktop. On Windows, right-click the image and choose Save picture as. On a Mac, hold the Control key while you click the image and choose Save Image As. Then use a trusted code reader on your phone to read the saved image and show you the address. Treat the address as text only. Do not paste it into your browser unless you have decided it is safe.
Either way, never type a password or card number into a page you reached through a code you were not expecting.
If you already scanned a bad code
Do not panic. Scanning alone usually does nothing. The risk comes from what you did next.
- If you typed a password, change it right away on the real website, and on any other site where you used the same one.
- If you entered card details, call the number on the back of your card and tell the bank. They can watch for charges and replace the card.
- If you installed an app, delete it. On Windows, open Settings, then Apps, find the program and remove it. On a Mac, drag it from the Applications folder to the Trash.
- Run a full scan with your antivirus program and let it finish.
What a tool can and cannot do
Antivirus software and browser warnings can flag a known bad page and tell you something is wrong. They do not fix the problem for you. Someone still has to change the passwords, clean up the computer, keep updates installed and watch for security warnings that pile up when nobody has time for them. Plenty of people would rather hand that cleanup to someone else, and that is a reasonable choice.
Until then, the habit that works is the one you can do today: slow down, read the address, and use the official route when money or a password is involved.
If you would rather have this watched and fixed for you, iFixediT paid plans protect your computer, Fixie runs common fixes when you tap Allow, and a person helps when you need one.