Should You Scan That QR Code? A Safety Checklist

Should you scan that QR code? This safety checklist gives you a calm, repeatable routine — a few things to check before you scan and a few more after — so a code has to earn your trust before it gets your tap. 🐾

QR codes are genuinely useful. They open menus, share Wi-Fi, ticket events, and speed up payments. The point of this guide isn't to make you afraid of every square — it's to give you a light mental habit that catches the rare bad code without slowing down the good ones. Most of it takes about ten seconds and quickly becomes second nature.

The one rule that matters most

If you remember nothing else, remember this: a QR code is only ever as trustworthy as the thing it points to. The code itself is just encoded text, usually a web address. It can't install anything on its own; the risk lives entirely in the destination. So the whole game is being able to see that destination before you commit to it. Everything below is really about making the invisible link visible and then judging it sensibly. For the why behind this, see can a QR code hack your phone?

Before you scan: reading the situation

Before your camera even comes out, a glance at the context tells you a lot.

Where did this code come from?

• Expected and official? A code on a product you bought, a bill you were waiting for, or a menu inside a restaurant is low-risk.
• Unsolicited? A code in an out-of-the-blue email, a random text, or a letter demanding urgent action deserves real suspicion. This is the classic setup for quishing.
• In a public place? Codes on parking meters, EV chargers, posters, and tables are easy for a scammer to cover with a sticker. Check whether the code looks original or stuck-on. Our guide to fake parking meter QR codes shows what to watch for.

Does the code look tampered with?

Look at the physical code. Is it a sticker sitting on top of another code? Are the edges peeling, misaligned, or a slightly different color than the surrounding print? Overlay attacks are common, and a mismatched sticker is often the only visible clue. We cover this in how attackers sticker over legitimate QR codes.

A sticker on top of a printed code is the physical-world version of a suspicious link. When in doubt, don't scan — ask a staff member or use the official app instead.

At the moment of scanning: preview the URL

This is the heart of the checklist. Nearly every modern phone camera shows you the decoded link as a preview before it opens anything. Read that link. A tool like QR Puppy is built around this idea — you can scan a code safely and see the real destination first, so you're deciding with your eyes open rather than tapping blind.

When you read the link, check:

Look for	Trust signal	Warning sign
The domain	The real, expected company domain	A look-alike (paypa1, amaz0n-secure)
The start of the address	Recognizable and clean	A shortener hiding the true target
Extra words in the domain	None	"-login", "-verify", "-support" bolted on
What it's asking for	Just opens a page	Prompts to join Wi-Fi, send an SMS, or download a file

Look-alike domains and shortened links are the most common tricks, and they're worth learning to spot. Our article on QR codes and malicious URLs breaks them down in detail.

After you land on the page: judge before you act

Even once a page loads, you still have every chance to stay safe. The scam only works if you do something.

• Does it ask for a password? Be extremely wary of entering login details on a page you reached by scanning. If you need to sign in, open the official app or type the website address you already know.
• Does it ask for payment or card details? Legitimate parking, tolls, and deliveries can almost always be paid through an official app or website you can navigate to yourself.
• Does it push urgency? "Your account will be closed," "pay now to avoid a fine" — pressure is a manipulation tactic, not a real deadline.
• Did it trigger an action? If scanning tried to auto-fill a text message, add a contact, or connect to Wi-Fi, stop and reconsider. See Wi-Fi QR codes: convenience vs risk.

Special cases worth extra care

Payments and crypto

Payment QR codes deserve their own pause, especially in crypto, where a swapped wallet address sends your money to a stranger with no way to reverse it. Always verify the recipient independently — see QR codes and crypto scams.

Wi-Fi codes

A Wi-Fi QR code can silently connect your phone to a network. On a code you trust (a café's own signage), that's convenient. On an unknown code, it could join you to a hostile network. Treat unexpected Wi-Fi codes with caution.

The quick version you can memorize

1. Source — was I expecting this code, or did it come to me?
2. Surface — is it a stuck-on sticker or original print?
3. See the link — preview the URL and read the domain.
4. Scrutinize — look-alike? shortener? extra words?
5. Stop before secrets — never enter passwords or payment from an unexpected scan.

Run that in your head and you'll defuse the overwhelming majority of malicious codes without a second thought. And if you ever do encounter a bad one, our guide on how to report a malicious QR code explains how to warn others. When you need to make your own codes, you can create a free QR code that encodes your real link directly, with nothing hidden.

Frequently asked questions

Is it dangerous to just scan a QR code?

Usually not by itself. Scanning normally only decodes a link and offers to open it. The risk begins when you visit the destination and then enter information or download something, which is why previewing the URL first is so effective.

How do I preview a link before opening it?

Most phone cameras display the decoded web address before loading the page — pause and read it. A scanner that clearly reveals the true destination first lets you check the domain for look-alikes and shorteners before you tap through.

What's the biggest red flag in a scanned link?

A domain that almost matches a brand you trust but isn't quite right, or a URL shortener that hides where you're really going. Combined with any request for a password or payment, that's a strong signal to back out.

Are QR codes on restaurant menus safe?

Generally yes, but check that the code is printed as part of the table or menu rather than a loose sticker added on top. Overlay stickers are a known trick in public spaces, so a mismatched or peeling code is worth a second look.

Should I use a special QR scanner app?

You don't need to, since modern phone cameras already show the link before opening it. What matters is using a scanner that clearly reveals the real destination first, so you can judge it rather than being sent straight to an unknown page.