Check a QR Code Before You Open It

The Short Answer

A QR code is just a link you cannot read. Scammers stick their own codes over real ones, or send codes by email and text, so the link takes you to a fake login or payment page.

Before you open a code, look at the link's real domain and ask one question: is this the site I expect? You can read a code without visiting it.

How to Check a QR Code, Step by Step

1. Don't tap straight away. On iPhone, the Camera shows the link at the bottom of the screen and only opens it when you tap. Read it first.
2. Or check it without opening anything. Take a screenshot or photo of the code and load it into the QR code reader. It shows the text and the domain and never visits the link.
3. Find the domain. Look at the part between :// and the next /. Read it from the right. The last two pieces (three for addresses like .co.uk) are the owner.
4. Compare it with what you expect. A parking meter run by your city should not send you to a domain you have never heard of. If in doubt, type the address you already know, or use the official app, instead of the code.
5. Look at the code itself. On a poster, meter or table, check for a sticker on top of the original. The FBI lists this as a sign of tampering.
6. Never pay or log in from an unexpected code. The FBI advises entering a known, trusted address by hand to make payments, and downloading apps only from your phone's app store.

Reading the Real Domain: Examples

Each of these was decoded with the QR code reader. The right-hand column is the domain it shows as the link's real destination.

The xn-- form is how browsers store domain names written in other alphabets. Some letters, like the Cyrillic “а”, look exactly like Latin ones, so a look-alike can be pixel-identical to a real brand.

Things That Trip People Up

• The padlock or https. It means the connection is encrypted, not that the site is honest. Scam pages use https too.
• A familiar name somewhere in the link. Only the end of the host name counts. bank.com.secure-login.example belongs to secure-login.example.
• Short links. bit.ly, tinyurl.com and similar hide where they lead. A real business printing a code rarely needs one, so be extra careful.
• Urgency. The FTC notes scam codes often come with a story: a missed delivery, a locked account, a payment that failed. Slow down and contact the company through an address or number you already know.
• “No warnings” is not “safe”. A checker can spot structural tricks, but a scam can sit on a plain new domain. The test is always whether the domain is the one you expect.

What the Authorities Say

The US Federal Trade Commission warned in December 2023 that scammers hide harmful links in QR codes, including stickers over codes on parking meters and codes sent by text and email. Its advice: inspect the URL before you open it, don't scan codes in unexpected messages, and keep your phone updated.

The FBI's Internet Crime Complaint Center published a public service announcement on tampered QR codes in January 2022. It advises checking the URL after scanning, looking for stickers placed over codes, not downloading apps or QR scanner apps from links, and typing a trusted address yourself to make payments.

Platform Notes

iPhone: Apple's instructions are to open Camera, point it at the code and tap the link that appears at the bottom of the screen. Nothing opens until you tap, so you have time to read it.

Codes in emails or on your screen: you can't point your phone's camera at its own screen. Take a screenshot and load it into the QR code reader, or on a computer paste it straight in with Ctrl+V.

Wi-Fi, contact and payment codes: the reader shows these as fields (network name, phone number, payment recipient) instead of a link. Check them just as carefully: a payment code decides who receives your money.