How to Check a QR Code Link Before You Scan It

Point your camera at the code, read the address that appears, and only then tap it. A QR code is just a picture of a link, so the checks you use on any link work here.

You cannot read a QR code with your eyes, which makes it a handy hiding place for a bad link. In the fourth quarter of 2025, the email security firm Mimecast detected 655,673 unique malicious QR codes, down 9% from 716,306 in the third quarter (APWG Phishing Activity Trends Report Q4 2025, published 18 February 2026). That is one vendor’s count from email attachments, not all QR scams, but it shows the scale.

Step 1: Point the camera, but do not tap yet

Open the camera app and hold it over the code. On both iPhone and most Android phones, a banner shows the web address. Do not tap it. Read it.

Step 2: Read the address

Use the same rule as for any link: find the name just before the ending (.com, .in, .co.uk) and the first single slash. That name is the owner. Does it match the company on the poster, the parking meter or the letter?

Be careful with these:

• A short link such as one from a shortening service. APWG’s Q4 2025 report says criminals pointed QR codes to URL shortening services, which sent users on to other destinations, to hide the nature of the code.
• A name that is close to a real one, such as park-pay-city[.]com for a council car park.
• A long address with the brand somewhere in the middle.

Step 3: Check the link without opening it

Copy the address from the banner (press and hold) and paste it into a link checker. It opens the page on its own browser, follows every redirect and shows the final address. Our guide to seeing where a short link goes covers this in more detail.

Step 4: Look at the code itself

In a public place, a printed sticker can be placed over the real code. Run a finger over the edge. A sticker that peels, or a code printed on a separate sheet, is a reason to walk away. Pay at a machine or a counter instead, or use the operator’s own app.

Also be suspicious of a code that arrives in an email or message when you did not ask for one. APWG notes that QR codes in emails are not caught by traditional email filtering, which is why criminals use them there.

Step 5: Ask what the page wants

A page you reach from a QR code that asks for a card number, a bank login, a one-time code or an app install is a sign of trouble. For parking, menus and tickets, use the venue’s own site or app when you can.

Why a QR code that was safe can turn bad

Some QR code generators let the owner change the destination after the code has been printed. The APWG report names this as a feature criminals use to stay ahead of detection. The code on a poster can point somewhere safe on Monday and somewhere else on Friday. So a code you checked last week is not proven safe today.

If you already scanned it and entered details

1. Close the page and enter nothing more.
2. If you typed a password, change it everywhere you used it. If you gave card details, call your bank on the number on your card.
3. If an app was installed, delete it and run your phone’s built-in security scan.
4. Report the link so its host can be asked to remove it.

Frequently asked questions