How to Spot a Malicious QR Code

QR codes went from a novelty to something people scan without a second thought — which is exactly what makes them a useful tool for scammers. The good news: a malicious QR code is usually spottable if you know what to look for.

Treat every QR code like a link from a stranger

That's the single most useful mental model. A QR code is just a link (or other data) in a different visual format — the same instinct that stops you from clicking a suspicious link in a text message should apply here. The code itself can't "infect" your phone just by being scanned; the risk is entirely in where it sends you or what it asks you to do next.

Watch for a sticker over another code

One of the most common scams in the wild: a fake QR code sticker placed directly over a legitimate one — on a parking meter, a restaurant table, a flyer, or an event poster. It looks completely normal because it's replaced the real thing. Before scanning, glance at the code for signs of tampering: a sticker with slightly different edges, printing quality, or paper stock than the surrounding material is a red flag.

Always check the URL preview before tapping through

Every modern phone shows a preview of the destination URL before actually opening it — this is your main line of defense. Before you tap "open," actually read it:

• Does the domain match who you'd expect? A code on a bank's flyer that resolves to a domain with no relation to the bank is an immediate red flag.
• Watch for misspelled or lookalike domains (an extra letter, a swapped character, a .net where you'd expect .com).
• Be suspicious of unexpected redirects or a URL that's suspiciously long and full of random characters.

Be extra cautious with unsolicited codes

A QR code that arrives out of nowhere — in an unexpected email, a text message, or a flyer for something you never asked about — deserves more scrutiny than one you sought out yourself, like a menu you scanned because you're already sitting at that restaurant.

What a malicious code typically tries to do

• Send you to a fake login page designed to steal credentials (a common target: parking payment or delivery-tracking pages)
• Trigger a download of a malicious app or file
• Pre-fill a payment or "confirm your details" form on a convincing fake site

Quick safety checklist

• Check for signs of a sticker placed over another code
• Always read the URL preview before tapping through
• Be more cautious with codes that showed up unsolicited
• If something asks for a password or payment info right after scanning, double-check the domain before entering anything

None of this requires special software — it's the same healthy skepticism you'd already apply to a link in an email, just extended to a format that's easy to scan without thinking.