Is this QR code safe? How to check where it goes before you open it (quishing)
A QR code is just a short piece of text, usually a web address, printed so a camera can read it. The danger is never the square itself; it is that you cannot see where it points before you go there. So read it first, then decide.
What a QR code can and cannot do
Scanning a code only reads text. Your phone then offers to do something with it: open a website, join a Wi-Fi network, add a contact, start a call or text, open an app, or pay. Nothing should happen until you tap that offer, and that tap is the moment to check. Scam codes work by sending you to a convincing fake page that asks for a password, card details or a small "fee".
Where scam codes turn up
- Stickers on real signs: parking meters and pay-and-display machines, EV chargers, bike and scooter hire, restaurant tables. A sticker over the original code, or a second code nearby, is the classic sign.
- Parcel and penalty notices: "we missed you, pay the redelivery fee" or "unpaid parking fine" cards and letters.
- Emails: "scan to re-confirm your two-factor sign-in" or "scan to read the shared document". A code in an email skips the link checks your email provider runs on normal links, and moves you to a phone where the address bar is tiny.
- Posters and flyers offering prizes, refunds or free Wi-Fi.
Read the web address properly
The only part of an address that decides who owns the site is the end of the host name, just before the first single / (two labels for .com, three for addresses like .co.uk):
| Address in the code | Real site | Trick |
|---|---|---|
https://www.royalmail.com/track-your-item | royalmail.com | None: the end matches |
https://royalmail.com.redelivery-fee.top/ | redelivery-fee.top | Brand name put in front of a different site |
https://royalmail-redelivery.com/ | royalmail-redelivery.com | Brand inside a longer, made-up name |
https://paypa1.com/ | paypa1.com | The digit 1 instead of the letter l |
https://аpple.com/ | xn--pple-43d.com | A Cyrillic а that looks like a Latin a |
https://[email protected]/ | 203.0.113.9 | Everything before @ is ignored |
https://bit.ly/3xYz | unknown until opened | Shortener or QR redirect hides the destination |
A padlock or https only means the connection is encrypted; scam sites have padlocks too. More on this in how to tell who really owns a link, and Wirebook's plain-English explanation of domain names.
Codes that do more than open a page
- Payment codes (UPI, crypto, some banking apps) send money. You never need to scan a code to receive money, and crypto payments cannot be reversed.
- Wi-Fi codes join a network. Anyone can make a code for a network called "Airport Free WiFi", so prefer mobile data for banking on public networks.
- Two-factor setup codes (
otpauth://) hand over the key that makes your login codes. Only scan your own, straight from the service's settings, and never send anyone a screenshot of one. - App links and phone numbers can open an app, start a premium-rate call or pre-fill a text. Check before you press send.
A quick routine
- Look at the code itself: is it a sticker on top of something, or in a message you did not expect?
- Read it without opening: phone cameras show a preview of the address; tap that only after reading it. Or use a scanner that shows the destination first.
- Check the real site at the end of the address. If it is not the organisation you expected, stop.
- For anything involving a payment or sign-in, go to the official app or type the address you already know instead of using the code.
Already scanned one and typed something in?
- A password: change it on the real site now, and anywhere you reuse it. Turn on two-factor sign-in.
- Card or bank details: call your bank using the number on the back of your card, and watch for small test payments.
- Installed an app from a link: uninstall it, and check your phone's device management or profile settings for anything you did not add.
- Report it: tell the car park, council, shop or company whose name was used. In the UK, scam emails can be forwarded to [email protected] and scam texts to 7726.
Related
Check a photo for location before you send it · Scan a QR code from a screenshot or picture · How to tell who really owns a link · How Wi-Fi QR codes work · Contact card QR codes · Try it: scratch a QR code until it stops scanning, then spot a fake sticker
Questions
Can scanning a QR code hack my phone?
Scanning on its own only reads text and shows you what the code wants to do. The risk comes from what you do next: opening a fake website and typing a password or card number, installing an app, joining a network or paying.
How do I check where a QR code goes without opening it?
Most phone cameras show the web address as a preview before you tap it; read it rather than tapping straight away. A scanner that decodes the code and shows the destination with warning signs, such as the Tooltern QR scanner, lets you check it on any device without opening the link.
What is quishing?
QR phishing: a scam that hides a link to a fake website inside a QR code, on a sticker, letter, poster or email, so you cannot see the address before you open it.
How can I tell if a parking meter QR code is fake?
Look for a sticker stuck over the original sign or a second code nearby, and check the website it opens is the operator's or council's official one. When in doubt, use the parking operator's official app or pay at the machine.
What should I do if I entered my card details after scanning a QR code?
Call your bank straight away using the number on the back of your card, so they can block the card and watch for fraudulent payments.
Published .