Is This QR Code Safe? How to Check Before You Scan
Quick answer
Before opening a code, look at the link your camera previews. Be wary of misspelled brand names, raw number addresses, unexpected payment or login pages, and stickers placed over another code. When in doubt, type the company's address yourself.
Microsoft reported QR phishing emails up 146% in the first quarter of 2026. Most attacks rely on people opening a link without looking at it.
Step by step
- 1
Preview the link
Your camera shows the address before opening it. Read the domain, not just the start.
- 2
Check the domain
Misspellings (paypa1, amaz0n), extra words (yourbank-secure-login.com) and odd endings are red flags.
- 3
Check the context
A sticker on a parking meter or a code in an unexpected email asking you to log in or pay is suspicious.
- 4
If unsure, go direct
Type the company's website yourself or use its app instead.
For businesses: make your codes trustworthy
Print your brand and what the code does next to it. Check public codes now and then for stickers placed over them. Use a branded domain for dynamic codes if you can (custom scan domains are on Business), and never send login or payment QR codes by email.
Frequently asked questions
Can scanning a QR code hack my phone?
Scanning only reads a link; harm comes from opening a malicious page and entering details or downloading something. Check the link before opening.
What is quishing?
QR phishing: using QR codes to send people to fake login or payment pages.