A poster in a café, a parking sign, a "scan to pay" note taped over a menu — QR codes have become so ordinary that scanning one barely registers as a decision anymore. That casual trust is exactly what makes them useful to scammers: a sticker over a real code, an image in an email, and suddenly a normal habit becomes the way in.
1. Check the link preview before you open it
Most phone cameras show a preview of the destination URL before you tap through. Read it the same way you'd read any suspicious link — look for domains that don't match who the code claims to be from, or addresses that are needlessly long and strange.
2. Be suspicious of QR codes in unexpected places
A sticker slightly overlapping a parking meter's original code, a QR code taped over a restaurant's usual one, or a code that looks physically different from the surrounding signage are all worth a second look. Scammers often physically cover a legitimate code with their own.
3. Treat QR codes in emails and texts like any other link
A QR code inside an email or message is just a link in image form — often used specifically because it slips past spam filters that would normally flag a suspicious text link. If you wouldn't click a link from that sender, don't scan their QR code either.
4. Never enter payment or login details right after scanning
If scanning a code leads to a page asking for your card details, banking login, or a password, stop and verify independently — go to the organization's official app or website directly instead of continuing through the scanned link.
5. Be extra cautious with "urgent" QR codes
A code that claims your package needs a fee, your parking is about to be fined, or your account needs urgent verification is using the same urgency playbook found in text and email scams — just delivered through a scan instead of a tap.
A quick checklist before you scan or act on a QR code
- Does the link preview match who the code claims to be from?
- Is the code in an unexpected place, or does it look stuck on top of another one?
- Did this code arrive in an email or text rather than somewhere I'd expect it?
- Is it pushing urgency — a fine, a fee, an account issue?
- Is the page after scanning asking for payment or login details?
More than one "yes" here is a good reason to close the page and verify independently.
Conclusion
QR codes themselves are just a way to encode a QR code link — a neutral piece of technology that scammers have learned to exploit precisely because scanning one feels so routine. The fix isn't avoiding QR codes altogether; it's giving the same three seconds of attention to the link preview that you'd give any other link.
This tactic often overlaps with fake delivery and parking-fee messages — if you want to see the text-message version of the same trick, our guide on checking a delivery message covers it in more detail.
Scanned something that led to a message or page you're unsure about? Paste the text into our free checker for a quick first read.
Frequently asked questions
Is it dangerous to just scan a QR code?
Scanning itself just opens a link — the danger comes from where that link leads and what it asks you to do next, such as entering payment details or downloading an app.
How can scammers place fake QR codes in real places?
A common method is printing a sticker with a fake QR code and placing it directly over a legitimate one, such as on a parking meter, restaurant table, or public poster.
Can my phone show me a QR code's destination before I open it?
Most modern phone cameras show a preview of the link at the top of the screen before you tap to open it. Always read that preview before proceeding.
Are QR codes in emails riskier than QR codes in public?
They carry a different risk: email QR codes are often used specifically to bypass spam filters that would normally catch a suspicious text link, since the destination is hidden inside an image instead of clickable text.
Got a message tied to a QR code you want checked?
Run it through the checker