How to Spot a Fake QR Code Before You Scan It

Updated 27 October 2026 · by the My Gadgets team

A QR code is just a link you can't read until you scan it, which is why scammers like them. A sticker on a parking meter, a "missed delivery" card or a code in an email can send you to a fake payment or login page that looks exactly like the real one. You can't tell a fake code by looking at the pattern. What you can check is where it was put, and where it points before you open it. This article shows both, plus what to do if you have already entered details.

Why are QR scams so effective?

Three things work in the scammer's favour:

• You can't see the address. A printed link like paypa1-secure.co looks wrong to many people. The same address inside a QR code looks like every other QR code.
• The context does the persuading. A code on a real parking meter, in a real restaurant or on a letter with a courier's logo borrows that place's trust.
• Phones are where checks are weakest. Small screens shorten addresses, and payment pages on a phone all look alike.

A code sent by email has one more advantage: email filters that inspect links may not decode a link that only exists as an image.

Where do fake QR codes turn up?

The safest assumption is that any code someone could have stuck there, someone might have.

What should I check before scanning?

1. Look at the code itself. Is it a sticker on top of something else? Is it crooked, or does it cover part of the printed design? Official codes are usually printed into the sign, not added later.
2. Ask whether you need a code at all. For parking, the operator's own app or the card reader on the machine does the same job. For a parcel, type the courier's address yourself and enter the tracking number there.
3. Be suspicious of codes that arrive by email or message, especially ones asking you to "verify", "unlock" or "re-activate" something. A real company can just send a link.

What should I check after scanning, before opening?

Most phone cameras show the address in a small banner before opening it. Read it, not just the first few letters:

• The domain is the part just before the first single /. In https://parking.example-city.gov/pay, it is example-city.gov. In https://example-city.gov.pay-now.site/, the domain is pay-now.site, whatever comes before it.
• Look for small misspellings: rn instead of m, 1 instead of l, an extra word (-secure, -verify, -support), or the wrong ending (.co instead of .com).
• Be wary of link shorteners (short addresses on services such as bit.ly). Real organisations use them on posters, but they hide where you will end up. If a shortened code asks you to pay or log in, find the organisation's site yourself instead.
• http:// without the s on a payment or login page is a reason to stop.

If the banner is too short to read the whole address, a dedicated scanner helps. QR Code Scanner shows what a code contains before doing anything with it: for a link, it lists the protocol, the host on its own line, the path and every parameter separately. It never opens a link by itself unless you switch that on in its settings, and it is off by default. Addresses with lookalike letters from other alphabets (a Cyrillic а in place of a Latin a, say) show in the host line in their encoded xn-- form, which makes them stand out.

You can scan a code with your camera or from an image, so a code inside an email or a PDF can be checked from a screenshot without pointing your phone at your own screen.

What kinds of codes are not links?

A QR code can also carry:

• Wi-Fi details, which join you to a network when you accept. A rogue network can watch unencrypted traffic and show fake login pages. Join networks you were told about, not ones a poster offers.
• A phone number or text message, which can be pre-filled to a premium-rate number.
• A contact card, which adds a contact that can later "message you from your bank".

The scanner shows these as what they are, for example a network name and password, or a number and message, before you choose to use them.

I scanned a fake code. What now?

Act according to what you did on the page:

• Only opened it: close the page. Opening a page alone is rarely harmful on an updated phone. Don't download or install anything it offers.
• Entered card details: call your bank on the number on the back of your card, block the card and ask for a new one. Check recent transactions.
• Entered a password: change it now on the real site, and anywhere else you used it. Turn on two-step verification.
• Installed an app or profile: remove it, and on a work phone tell your IT team.
• Paid a "fee": contact your bank about disputing the payment, and report the scam to your local fraud reporting service.

Then report the fake code itself: to the car park operator, the restaurant or the company it impersonated, so others don't fall for it.

Quick answers

Can scanning a QR code hack my phone? Scanning only reads the text inside the code. The risk comes from what you do next: opening a page, entering details, installing something or joining a network.

Are QR codes in official letters safe? Usually, but check that the link goes to the organisation's own domain, and if in doubt type the address from their website instead.

Is it safer to scan with an app than the camera? The camera is fine if you read the address it shows. A scanner that shows the full address before opening anything makes that easier.

Can I check a code without a phone? Yes. Take a screenshot or photo of it and open the image in QR Code Scanner on a computer.

What to do next

Next time a code asks you to pay or log in, check the address with QR Code Scanner before opening it. If you make codes for your own business, QR Code Generator can put your full web address in the code rather than a shortened one, so your customers can see where it leads.