Is This QR Code Safe to Scan? How to Check Before You Tap

Short answer: you usually cannot tell by looking. A QR code is a link wearing a disguise. The pattern of squares carries no information a human eye can read, so a code that leads to a legitimate payment page and a code that leads to a credential-stealing copy of that page look exactly alike. The only reliable way to know is to check the destination before your phone opens it.

That is the whole problem in one sentence, and it is why QR scams work so well. Below is what actually distinguishes a risky code from a safe one, what to do if you have already scanned something, and how to check any code in a couple of seconds.

Three quick tells that a code is risky

None of these are proof on their own, but each one meaningfully raises the odds that a code was placed by someone other than the business it appears to belong to.

• It is a sticker sitting on top of something else. Run a fingernail along the edge. A genuine code is usually printed directly onto the sign, menu, meter, or placard. A peel-and-stick label applied over the original is the single most common physical QR scam, and it takes a scammer about four seconds to apply.
• It arrived unexpectedly, in a message you did not ask for. A missed delivery notice, an unpaid toll, a locked account, a refund you did not request. Legitimate organizations almost never ask you to resolve an urgent account problem by scanning a code out of a text message.
• Scanning it immediately asks for a login or a payment. A real menu shows you a menu. A real parking meter shows you a parking session. If the very first screen wants your card number, your password, or a one-time code, treat that as a stop sign rather than a step.

What a safe code usually looks like

The reassuring signals are quieter than the alarming ones, which is part of why people miss them.

• The code is printed as part of the surrounding design rather than added on top of it, and the ink matches the rest of the sign.
• You went looking for it. You chose to scan a menu, a ticket, or a WiFi card, rather than being prompted to scan by a message that found you.
• The page it opens matches the business you are standing in front of, uses a domain you would expect, and does not immediately demand credentials.

How to check a QR code before you tap

Both iPhone and Android show a preview of the link before opening it, and that preview is worth reading rather than dismissing.

1. Point your camera but do not tap yet. A banner appears with the destination. Hold still and read it.
2. Read the domain from right to left. The important part is the last two segments before the first single slash. In secure-login.example-verify.com, the real domain is example-verify.com, not secure-login. Scammers put trusted-looking words on the left because that is where people stop reading.
3. Be careful with shortened links. If the preview shows a link shortener rather than a recognizable business domain, the real destination is still hidden from you. See our guide to expanding shortened URLs.
4. When the code matters, type the address yourself. For anything involving a payment or a login, going to the site directly costs you fifteen seconds and removes the risk entirely.

What to do if you already scanned it

Scanning a QR code by itself is rarely the damaging step. A code cannot install anything on a modern phone just by being scanned. The damage happens on the page that opens afterwards, so what matters is what you did next.

• If you only looked at the page and closed it, you are almost certainly fine. Close the tab and move on.
• If you entered a password, change it now on the real site, and change it anywhere else you reused it. Turn on two-factor authentication while you are there.
• If you entered card details, contact your bank or card issuer, report it as fraud, and ask them to freeze or reissue the card. Card issuers deal with this daily and can usually reverse recent charges.
• If you approved a login prompt or entered a one-time code, treat the account as compromised. Sign out all sessions from the account security settings, then change the password.
• If you downloaded a file or installed an app, remove it, then restart the phone.
• Report it. In the US, file with the FTC at reportfraud.ftc.gov. If a physical sticker was involved, tell the business or the local authority so they can remove it before someone else scans it.

Why you cannot rely on the code itself

People often ask whether a malicious code looks different, or whether a particular pattern in the corner is a warning sign. It does not, and it is not. The visual differences between two QR codes reflect the length of the data and the error-correction level, not whether the destination is trustworthy. Two codes pointing at completely different sites can look nearly identical, and the same destination encoded twice can produce two codes that look quite different.

This is also why "check the code carefully" is not workable advice on its own. The check that actually helps is a check on the destination, which is what a security-aware scanner does automatically: it reads the code, resolves where the link really ends up, and flags a known-bad destination, a fake payment screen, or an unsafe WiFi network before the page can load.

Frequently asked questions

Can scanning a QR code hack my phone?

Not on its own. Scanning reads data and shows you a link. The risk comes from what you do afterwards: opening the page, entering credentials, approving a payment, or installing something it offers you. Keeping your phone updated closes the narrow set of cases where a malicious page could exploit a browser flaw.

How can I tell if a QR code is safe without scanning it?

Judge the context rather than the code. Is it a sticker over the original? Did it arrive unsolicited? Does the surrounding sign look tampered with? If you need to scan it, use a scanner that shows and checks the destination before opening it.

Are QR codes in restaurants and cafes safe?

Usually, though they are a common target for sticker swaps because the codes sit at table height where anyone can reach them. See our guide to restaurant QR menus.

Is it safe to scan a QR code from a text message?

Treat it as unsafe by default. Unsolicited QR codes in texts are one of the fastest-growing scam formats, largely because a code slips past filters that would catch a suspicious link. See what these messages look like.

Does my phone warn me about bad QR codes?

Built-in camera apps show you the link but generally do not evaluate whether the destination is dangerous. They will happily preview a phishing page the same way they preview a real one. Checking the destination against threat intelligence blocklists is a separate step, and it is what ScanLikely adds.

Not sure if a QR code is safe? Check it before you tap.

ScanLikely scans the code and warns you before it opens anything sketchy, links, fake payment pages, rogue WiFi, and more. Free on iPhone and Android.