How do you check if a QR code is safe?
To check if a QR code is safe, read the link your phone shows before you tap it, and judge it by its host name: the site's address after https://, which tells you who runs the page. Some links are built to hide the real host, and the section on reading a link shows how to find it. If the host is the real domain of the business you expect, opening it is usually fine. If it is a short link, a long string of words, or a domain you have never seen, copy it instead of opening it and look at where it leads. A code on a sticker, in an unexpected letter or email, or inside a package you didn't order should get the most suspicion, whatever it says.
Why QR code scams are in the news in November 2026
Phishing through QR codes, usually called quishing, has been building all year. In its H1 2026 threat report, ESET says QR codes appeared in about 11% of the phishing emails it detected. It also reports around 100,000 QR phishing detections a month, peaking in April, with the most detections in the US, Spain and Mexico.
Street-level scams are back in the news too. On 5 November 2026 the German tech site teltarif.de warned about stickers pasted over the real codes on parking meters and EV chargers that lead to fake payment pages. A day earlier, police and a regional savings bank in Oldenburg warned customers about fake bank letters asking them to scan a code to "confirm" their details. In the US, the FTC published a parking-meter QR alert on 3 September 2026 and, in August, described packages you never ordered that arrive with a QR code note inside.
The FBI explains why attackers like the format. Its FLASH alert of 8 January 2026 on the North Korean group Kimsuky says a QR code sent as an image gets past the link scanning that mail filters do, and moves the victim from a protected work computer to a personal phone. After the scan, the victim passes through redirect servers that record the user agent, operating system, IP address, locale and screen size before showing a login page built for phones. It also explains how a link checker can report a dangerous link as harmless.
What a QR code actually contains
A QR code is printed text. Scanning it decodes that text and nothing else happens until you act on it. Phones recognise a few formats and offer an action for each, and every format can be misused in its own way:
| What the code holds | What your phone offers | What to check before you tap |
|---|---|---|
A web address (https://...) | Open it in the browser | The host name in the preview (see the next section) |
Wi-Fi details (WIFI:S:CafeGuest;T:WPA;P:...;;) | Join the network | That the network name is the one staff told you; a fake hotspot can watch unencrypted traffic |
| A payment request | Open your payment app with a payee filled in | The payee name the app shows, and that you are paying, not "receiving" |
A text message (SMSTO:) or phone number | Open messages or the dialer with the text ready | The number; nothing is sent until you press send |
| A contact card or calendar event | Add a contact or event | Any web link inside it, which you can check the same way |
So the code itself can't do anything harmful. The risk starts with the page, network or payment you open after the scan. Most phone cameras show the action in a small banner before doing anything, and that banner is your chance to check it.
How to read a QR code link: the host name is what matters
A web address has one part that decides who controls the page: the host name. Read it from right to left. The last two labels (or three for endings such as .co.uk) are the domain that someone registered and pays for. Anything to the left of them is a subdomain, which the domain owner can name however they like. In https://citypay.com.parking-fines.example/pay, the registered domain is parking-fines.example, and citypay.com is just a label its owner added at the front.
To see how a browser actually parses tricky links, paste one into the URL encoder and decoder, tick Encode full URL and press Encode. It shows a component breakdown made by the same URL parser your browser uses. These are the results for four test links (the domains are made up):
| Link as printed | Host the browser would contact | The trick |
|---|---|---|
https://paypal.com@login-check.example/verify | login-check.example | Everything before @ is a user name, not the site |
https://раypal.com/pay | xn--ypal-43d9g.com | The first two letters are Cyrillic; the parser shows the real (punycode) name |
https://citypay.com.parking-fines.example/ | citypay.com.parking-fines.example | A familiar name used as a subdomain of someone else's domain |
https://login-check.example/?ref=%2F%2Fcity.gov | login-check.example; ref decodes to //city.gov | A trusted name hidden in an encoded query string, which proves nothing |
A host label that starts with xn-- is punycode, the form browsers use for names with letters outside plain a to z. It can hide accented letters (bücher.example becomes xn--bcher-kva.example) or other scripts, which is normal for many sites. A punycode name that looks like a well-known brand written in plain Latin letters is a red flag. A number after a colon, as in login-check.example:8443, is a port and is not part of the host. The FTC gives the same advice in plainer words: look for misspellings and swapped letters in the preview before you tap it.
How to check a QR code without opening it
You don't have to open a link to find out where it leads. On most phones you can press and hold the link banner or choose "copy" instead of "open". If you already took a photo or screenshot of the code, the photo app or a visual search app on recent phones can read the code from the picture and show the text. Then:
- Paste the link somewhere you can read all of it, such as a notes app or the URL encoder's breakdown.
- If the host is a link shortener or a domain you don't know, run the link through the redirect checker. It requests the link from our server, follows the chain for up to 20 hops and lists every hop with its status code, so your phone never contacts the site.
- Check the final domain against the business you expected. For an extra signal, look it up in Google's Safe Browsing site status, which flags sites Google has already found to be dangerous.
An ordinary chain is short and stays on one domain. A redirect check of http://indemandtools.com/tools/qr-code-generator/ returned three hops: a 301 to the HTTPS version, a second 301 that removes the trailing slash, then 200 at https://indemandtools.com/tools/qr-code-generator. A chain that jumps from a shortener to a fresh domain, then to another one, deserves far less trust.
What a QR code scam checker cannot tell you
Any link checker, ours included, sees the link from a server, not from your phone. Ours sends header-only requests with its own user agent, and it does not run JavaScript or follow meta-refresh tags, which some phishing pages use to move visitors along. The FBI alert describes redirect servers that look at the device before deciding what to show, so a phishing kit can send a checker to a harmless page while phones get the fake login. So a clean result only tells you the server-side chain looked fine, and the same link may lead somewhere else on a phone.
A second limit applies to codes in targeted emails and letters. Those links often carry an ID that belongs to you, so any visit, even from a checker, can tell the sender the message reached someone. For an email or letter you didn't expect, the safer choice is to skip the code and go to the company's site or app yourself.
Where QR code scams show up, and what to do instead
The same few setups appear in nearly every warning from this year. Each one has a safer route that doesn't involve the code at all:
| Where you see the code | The usual trick | Safer route |
|---|---|---|
| Parking meter or pay station | A sticker over the real code leads to a fake payment page | Run your finger over the code to feel for a sticker edge; pay in the operator's app or at the web address printed on the sign |
| EV charger | Same sticker trick, aimed at card details | Start the charge from the charging network's own app |
| Letter from a bank or authority | "Scan to confirm your data" with a deadline | Log in through the address you normally type or your bank's app; call the number on your card |
| Work email | A "secure drive", a questionnaire or a conference sign-up, all lures in the campaigns the FBI describes | Open the service from your bookmarks; report the email to IT |
| Note inside a package you didn't order | A code that leads to a page asking for card or login details | Don't scan it |
| Payment code at a shop or from a buyer | A code that sends money from you when you were told you'd receive it | Read the payee name and amount in your payment app before you approve |
Most of these lures come with a deadline, such as a fine that doubles in 24 hours, to rush you past the preview.
Is it safe to scan QR codes on iPhone and Android?
Scanning with the built-in camera on an up-to-date iPhone or Android phone is safe in itself, because the camera only decodes the text and asks before it opens anything. Keep the system and browser updated, as the FTC advises, since a browser flaw is the rare case where opening a page could do harm without your input. A separate QR scanner app adds nothing the camera can't do, and it is one more app with access to your camera.
Two-factor codes help less than people expect. The FBI alert says QR phishing campaigns often end with stolen session tokens, which let an attacker use an account you just signed in to without seeing an "MFA failed" warning. Passkeys hold up better: a passkey is tied to the real site's domain, so your phone won't offer it on a look-alike domain.
What to do if you already scanned a bad QR code
If you opened the page but typed nothing, close the tab. Then check what you gave away and work through the list below in order:
- If you entered a password, change it on the real site, using the address you type yourself. Make the new one unique; the password generator builds passwords of 6 to 64 characters in your browser with
crypto.getRandomValues(). Change it anywhere else you used the same password. - Sign out of all other sessions. Most email and cloud accounts have this option in their security settings, and it ends any session the attacker already took over.
- If you entered card details, call your bank to block the card and watch your statements for charges you don't recognise.
- If the page made you install an app or a profile, remove it, then check your account security settings again.
- Report it. In the US, use ReportFraud.ftc.gov, or the FBI's IC3 if money was lost. Tell the parking operator, shop or bank too, so the sticker comes down before the next person scans it.
For businesses: how to make a QR code people can check
Everything above asks customers to judge your code by the host name in their preview. You can make that easy. Encode your own domain directly, so the preview shows the name people already know. A dynamic code from a QR service usually sends every scan through that service's domain first, which looks the same as a scammer's redirect; the guide to free QR codes with no sign-up or watermark covers the difference between static and dynamic codes. The QR code generator on this site makes static codes in your browser, with nothing between the scan and your page.
Keep the link short as well. At the same print size and error correction level, a shorter address gives a code with fewer, larger modules (the small squares), which is easier to scan from further away. These figures come from the generator's Version and Modules readouts for four versions of one café menu link. The last column is the size of one module when the code, plus its standard four-module margin, is printed 25 mm wide:
| Link length | Error correction M | Error correction H (needed for a logo) | Module size at 25 mm (M / H) |
|---|---|---|---|
| 15 characters | Version 2, 25 x 25 | Version 3, 29 x 29 | 0.76 mm / 0.68 mm |
| 29 characters | Version 3, 29 x 29 | Version 4, 33 x 33 | 0.68 mm / 0.61 mm |
| 85 characters (with UTM tags) | Version 6, 41 x 41 | Version 9, 53 x 53 | 0.51 mm / 0.41 mm |
| 141 characters (five tracking parameters) | Version 8, 49 x 49 | Version 12, 65 x 65 | 0.44 mm / 0.34 mm |
The longest link with a logo has modules less than half the size of the shortest one without a logo. If you need tracking, use one short parameter instead of five. Adding a logo pushes the code to level H, as the QR code with logo guide explains, so leave the logo off codes that have to scan in poor light.
A few habits make tampering easier to spot:
- Print the web address in plain text under the code, so people can compare it with the preview.
- Print the code into the sign or menu itself instead of using a sticker, and check public signs for added stickers.
- Never ask customers to log in or pay through a QR code in an email or letter. Then anyone who receives such a message from "you" knows it's fake.
Frequently asked questions about QR code safety
What is quishing?
Quishing is phishing that uses a QR code instead of a clickable link. The code leads to a fake login or payment page, or asks you to install something. Because the link is inside an image, it often gets past email filters, and because you scan it with your phone, it skips the protection on your work computer.
Can scanning a QR code hack your phone?
Scanning alone only decodes text, and the camera asks before opening anything. Harm comes from what you do next: entering a password or card number on a fake page, joining a fake Wi-Fi network, or installing an app. Keeping your phone updated covers the rare browser flaws that could be exploited by just opening a page.
Is there a QR code scam checker that catches everything?
No. Checkers and blocklists catch known bad sites and obvious redirect chains, but new phishing domains are often not listed yet, and some phishing kits show a harmless page to anything that isn't a phone. Use a checker as one signal, together with reading the host name and asking whether you expected the code at all.
How do I check a QR code from a photo or screenshot?
Open the picture in your phone's photo app or a visual search app, which can read codes in images, and copy the link instead of opening it. Paste it into a notes app or a URL breakdown tool to read the host name, and use a redirect checker if it's a short link.
Is it safe to scan a QR code for payment?
It can be, if the code is printed by the shop and your payment app shows the merchant's name and the amount you expect. Stop if the payee name is a private person or a different business, if the amount is filled in for you without reason, or if someone tells you to scan a code to receive money.
Are QR codes on restaurant tables safe?
Usually, but check that the menu opens on the restaurant's own domain or a menu service the staff can confirm. A menu has no reason to ask for card details or a login before showing you the food. If it does, ask the staff for a paper menu.
