QR code scams: what to check before you scan

A QR code is a convenient way to open a link, not a guarantee that the destination is trustworthy. Treat a code on a parking sign, message, or package with the same care you would give an unfamiliar web address.

1. Check the situation first

Was the code expected, and does the request make sense? Be cautious about urgent messages asking you to scan to fix an account or rearrange a delivery. On a physical sign, look for a sticker placed over the original code. The FTC describes these QR-code scam tactics.

2. Read the destination before opening it

If your camera shows a link preview, inspect the address before tapping. Look for spelling changes or an unrelated domain. If the destination is unclear, use the organization’s known website or app instead. A professional-looking page is not proof that you reached the right service.

For example, if you are paying for parking, confirm the operator and location using its official app or information from the venue. Do not let a countdown on an unfamiliar page rush you into entering a card number.

3. Be wary of unexpected packages

A package with no clear explanation may include a code claiming to identify the sender. The FTC warns that this can lead to a phishing page. You do not need to scan it to investigate the delivery; start with the retailer or carrier through a trusted contact route.

4. If you already opened the link

Opening a page and entering a password are different events. Note what actually happened: did you only view it, submit information, download a file, or install something? Close the questionable page and use our suspicious-link response guide for the next steps.

Keep the message or a photo of the suspicious sign if you need to report it, but avoid forwarding the live link as a recommendation. Alert the venue through its real contact details.

Build one simple habit

Pause at the destination preview. If you cannot connect the address with the task you intended to complete, take another route. Our message-checking guide applies the same habit to email and texts.