QR code scam prevention is a habit, not a panic button.
The goal is simple: slow the scan down just enough to see where the code goes, who controls it, and what it asks you to do next. Most QR scams need one extra action after the scan: pay, sign in, install something, approve a device, enter a card, or share personal information.
Use this hub as the starting point before scanning unfamiliar codes at home, work, school, travel, restaurants, parking lots, events, stores, or in messages.
The prevention workflow
| Step | What to ask | Stop if | |---|---|---| | Inspect the code | Does the sign or sticker look official and untampered? | It is pasted over another code or looks out of place | | Preview the destination | What domain, app, or redirect will open? | It uses a strange short link or mismatched domain | | Verify the source | Did the business, school, agency, or sender provide this code? | The code came from an unexpected message or loose flyer | | Check the ask | What does the page want you to do? | It asks for payment, login, MFA, files, or permissions unexpectedly | | Use a safer path | Can you open the official app or site directly? | The QR code is the only path to a sensitive action |
1. Inspect the physical code
Public QR codes are useful because anyone can scan them. That also makes them easy to tamper with.
Before scanning a code on a parking sign, restaurant table, payment placard, kiosk, package insert, flyer, or event booth, look for raised edges, mismatched paper, crooked stickers, damaged surfaces, and signs that do not match the surrounding branding.
High-risk places include:
- Fake Parking Meter QR Code Scam
- Fake QR Code at Checkout
- QR Code Sticker Inspection Checklist for Businesses
2. Preview the destination before opening
A QR code can hide a destination until the scan. Preview helps you catch odd domains, short links, redirects, and unexpected app prompts before the page opens.
Check whether the destination matches the expected business, agency, app, school, event, bank, or payment provider. If the QR code says it belongs to a city, restaurant, airline, or payment app, the domain and page context should make sense.
Useful scanner guides:
3. Verify sensitive requests outside the QR code
Treat these requests as sensitive:
- Account login
- Payment or card entry
- Gift card claim code
- MFA or authenticator setup
- Device approval
- File download
- Configuration profile
- Location, contact, photo, or notification permission
If a QR code asks for any of those, use the official app, saved bookmark, typed domain, known phone number, staffed counter, or account settings page instead.
For recovery steps after a suspicious scan, start with What to Do If You Scanned a Suspicious QR Code.
4. Watch message-based QR codes
QR codes in texts, emails, DMs, PDFs, and support chats are common in quishing. The message may claim to be from a bank, delivery company, school, employer, airline, tax agency, payment app, or marketplace.
The safer rule is direct navigation. Open the official app or website yourself and check whether the same notice appears there.
Related guides:
5. Build a habit for work and family
QR scam prevention works better when everyone has a shared rule. Families can agree to verify payment, account, school, travel, and healthcare QR codes before scanning. Businesses can keep a QR inventory, inspect public signs, and train staff to report suspicious codes.
Good starting resources:
When to stop immediately
Stop and use another path if the QR code:
- Came from a message you did not expect.
- Uses urgency, penalties, refunds, prizes, account lockout, or limited-time pressure.
- Opens a payment page without clear merchant context.
- Sends you to a login page from a public sign or message.
- Asks to install a profile, download a file, approve a device, or reset MFA.
- Does not match the domain, app, or person you expected.
See also
- How to Spot a Malicious QR Code Before You Scan
- QR Code Threat Map
- What Happens If You Scan a Fake QR Code
- Payment QR Code Scam Guide
- QR Code Scam Red Flags
Preview unfamiliar QR destinations before opening them. Download QRsafer for iOS or Android.
Frequently asked questions
What is the simplest way to prevent QR code scams?
Pause before opening the destination. Check who posted the code, preview the URL, verify the domain or app, and stop if it asks for payment, login, files, permissions, or account approval unexpectedly.
Are public QR codes risky?
They can be. Codes on parking signs, counters, flyers, tables, kiosks, and event booths are easier to replace or cover with stickers, so they deserve a quick destination check.
Should I scan QR codes from texts or emails?
Only when you expected the message and can verify the sender. For account, bank, delivery, tax, travel, or payment messages, open the official app or website directly instead.
How can QRsafer help prevent QR scams?
QRsafer previews and checks QR destinations before they open, helping you catch suspicious links, redirects, and app handoffs earlier.