QR code phishing: how to scan a QR code safely
A QR code is just a link you cannot read. That is exactly why scammers like them: the address stays hidden until your phone has already opened it.
The short version
- Before you open a QR code, read the address your camera shows in the preview.
- Look for stickers placed over the real code on parking meters, chargers and posters.
- Be most suspicious of QR codes in emails and PDFs asking you to sign in or re-verify.
- For payments, use the official app or type the address instead.
Where fake QR codes turn up
- Parking meters, EV chargers and bike rentals: a printed sticker over the real code leads to a fake payment page.
- Emails and PDF attachments: "scan to keep your mailbox active" or "scan to sign the document". Moving the link into an image hides it from email filters and moves you from a protected work laptop to a personal phone.
- Fake parking tickets or delivery notices left on cars or in letterboxes.
- Restaurant tables, posters and flyers, where anyone can stick a code on top of the real one.
Four habits that make scanning safe
Read the preview before you tap
Most phone cameras show the address before opening it. Read the domain as described in How to check a link before you click. If it is not the company you expect, stop.
Check the code itself
Run a finger over it. A sticker, a slightly raised edge, or a code that looks newer than the sign around it are warning signs.
Never sign in from a QR code in an email
Your bank, your email provider and your employer do not need you to scan a code to keep an account working. Open the app or type the address instead.
Pay through the official app
For parking, charging and tickets, use the operator's app or the address printed on the official sign, not a code you cannot verify.
Not sure about a code you already scanned? Copy the address from your phone and paste it into the scan box below before you enter anything.
Check a link now, free
Paste the link you are unsure about. It opens in an isolated browser on our side, never on your device, and you get a verdict with the evidence behind it. No account needed.
Questions people ask
- Can a QR code hack my phone just by scanning it?
- Scanning only reads a link. The risk starts when you open it and type a password or card details, or install something it offers. Reading the preview first removes most of the risk.
- I paid through a fake parking QR code. What now?
- Call your bank on the number on your card, block the card, and follow I clicked a phishing link: what to do now. Report the sticker to the parking operator or the local police.
More guides
Eight quick checks to tell a real link from a phishing link: see the real address, read the domain the right way, spot lookalikes, and scan it for free.
How fake delivery, bank, tax and new-number text messages work, the signs that give them away, and what to do if you receive or clicked one.
Clicked a phishing link or typed your password into a fake page? The steps to take right now, depending on what happened, in the order that limits the damage.