QR Codes Are Links in Disguise: Scan With Care

Treat the destination like a link

A QR code does not certify the page it opens. It simply encodes information, often a web address, and a scammer can place a replacement sticker over a legitimate code on a menu, parking sign, or parcel. The resulting page may imitate a familiar company, request a password, or ask for payment details. A QR image in an email or text can serve the same purpose as a deceptive clickable link.

Check before continuing

Use your phone camera's preview to read the domain before opening it. Look for misspellings, extra words, or an unrelated domain, and do not treat a padlock or HTTPS alone as proof that a site is honest. For parking, transit, or a bill, find the official app or type the known address rather than trusting a code that looks newly pasted over. If the code asks you to install an unfamiliar app, stop.

Pay and sign in safely

Never enter account credentials or card details simply because a scan directs you to a page that looks branded. Open your payment provider separately and confirm the transaction there. If a QR code has been placed in an unexpected package or message, verify the sender using a known contact route instead of scanning. Report suspicious codes to the venue or organization so staff can inspect the physical sign.

Sources and further reading

• FTC: Scammers hide harmful links in QR codes
• CISA: Recognize and Report Phishing