A QR code is just a short piece of text printed as squares, and pointing your camera at one does nothing on its own. The risk starts when you open what it contains: a page that asks for your password or card, an app to install, a payment request. Scammers use QR codes because you cannot read them by eye, so a fake address gets past the one check people normally make. The good news is that you can still make that check. It takes a few seconds, and you only need to know which part of the address to read.
Read the address before you tap
iPhone and Android cameras show a preview of the link before opening it. Stop there and read it. The rule that
catches most fakes: the site you are going to is decided by the end of its name, the part just
before the first single /. Everything in front of it can be chosen freely by whoever owns that end.
We put eight trick addresses into QR codes and checked, in Chrome 156, which site each one would really connect to. The addresses use reserved example names, so none of them leads anywhere:
| The code contains | Chrome would go to | The trick |
|---|---|---|
https://paypal.com@example.net/login | example.net | Everything before an @ is thrown away. The name you read first is not the site. |
https://paypal.com.example.net/login | example.net | The address starts with a real company’s address, but it is only the first part of a longer name. |
https://pаypal.com/login | xn--pypal-4ve.com | The second letter is a Cyrillic “а”, identical on screen. Behind the scenes it is a different site. |
https://bit.ly/3xAmpLe | bit.ly, then wherever it sends you | A link shortener hides the destination until you open it. |
http://203.0.113.7/pay | 203.0.113.7 | A bare number instead of a name, and plain http without encryption. Real businesses almost never do this. |
https://pay.parking.city.example.net/meter/4417 | example.net | Many reassuring words in front; only the last two decide the owner. |
https://example.net/app/ParkingPay.apk | example.net | Not a page at all: a link that downloads an app. |
https://www.example.net/menu | www.example.net | No trick: an ordinary address. Still check that the name is the one you expect. |
So for paypal.com.example.net, read from the end: example.net. That is the site, and it is
not PayPal. Watch for a dash in the same place too: paypal.com-secure.example.net also belongs to
example.net. If the preview is too short to show the whole name, or the address uses a shortener, do not open it
from the code; type the company’s address yourself instead.
Look at the code itself
On parking meters, EV chargers, restaurant tables and posters, the most common trick is a sticker pasted over the real code. The FBI warned about tampered codes in 2022, and the US Federal Trade Commission has since singled out parking meters. Before scanning one in public:
- Touch it. A raised edge, a sticker that sits slightly crooked or a second code underneath means someone has covered the original.
- Check that it belongs there. A parking meter that names an app or a website on its own sign does not need a QR code to a different one.
- For payments, skip the code. Pay through the parking operator’s official app or the website printed on the meter, which you type yourself.
Codes that arrive by email, text or post
The FTC’s advice is short: do not scan a QR code in an email or text you were not expecting, especially one that says your account is locked, a parcel could not be delivered or a payment failed. These messages put the link in a picture partly because a picture is harder for spam filters to check, and partly because on a phone you then have to scan it with a second device or open it blind.
You can read such a code without opening it. Take a screenshot of the email (or save the picture), then drop it on our QR Code Scanner or press Ctrl+V on that page. It shows the address the code holds, puts the part that decides the owner in bold, and warns about the tricks in the table above — and it opens nothing until you press the button. The picture is read on your device and never uploaded. The same works on a phone: screenshot the message, open the scanner page in your browser and choose the screenshot.
Payment, Wi-Fi and login codes
Not every QR code is a web link. Some act the moment you accept them, so know what you are looking at:
- Payment codes (UPI in India, EPC bank-transfer codes in Europe, crypto addresses) fill in a payment for you. Scanning a UPI code sends money; anyone who asks you to scan one so that you can receive money, such as a buyer or a “refund agent”, is running a scam. Check the payee’s name and account before you confirm.
- Wi-Fi codes join you to a network. In a café or hotel, check that the network name matches the place; a fake hotspot can watch unencrypted traffic.
- Two-factor login codes (the kind that start
otpauth://) add an account to your authenticator app. You only ever scan these while setting up your own login. One sent to you by someone else is not legitimate. - App downloads. If a code wants you to install an app, find that app in the App Store or Google Play yourself instead.
If you already opened it
- Typed nothing? Close the page. Opening a page is rarely enough to harm a phone that is up to date.
- Entered a password? Change it right away on the real site, typed by hand, and anywhere else you use the same password. Turn on two-factor login.
- Entered card or bank details? Call your bank using the number on your card and ask them to block it.
- Installed an app? Delete it, and on Android check Settings → Apps for anything you do not recognise.
- Report it. In the US at ReportFraud.ftc.gov, in the UK to Action Fraud. Scam texts can be forwarded to 7726 in both countries.
How we tested
Each of the eight addresses was turned into a QR code with the same library as our
QR Code Generator, read back from the picture, and handed to Chrome 156’s own
address parser to see which site it would connect to. All eight read back exactly. We also checked what our
scanner showed for each one; while testing, the paypal.com.example.net pattern came out as an
ordinary link, so we added a warning for addresses that start like another site and checked that eight real
addresses, including Google Maps share links and bbc.co.uk, do not set it off. The FBI and FTC
warnings are their public advice; we did not test parking meters or phones ourselves.