I Scanned a QR Code and It Redirected Me — Should I Be Worried?

Why QR codes redirect in the first place

A QR code is just a visual representation of a URL. Most of the time that URL isn't the final destination — it's a short link that immediately bounces your browser to a longer address. This is standard practice, and there are three common reasons it happens:

• Short URLs. Services like Bitly, QR.io, or a company's own short domain keep the QR code compact and let the owner update the destination without reprinting the code. Your browser briefly visits the short URL, receives a redirect instruction, and loads the real page.
• Analytics tracking. Many businesses route QR scans through a tracking layer so they can count how many people scan each code, when, and from where. This adds a hop before the final destination.
• Dynamic QR codes. Dynamic codes let the owner change where they point after printing. A restaurant can update its menu URL without reprinting table cards. Every scan goes through a redirect managed by the QR code platform.

In all of these cases, the redirect is legitimate and harmless. The question is whether the final destination is what you expected.

When a redirect is a red flag

Scammers also use redirects — specifically to hide the true destination of a malicious QR code. A sticker QR placed over a legitimate code at a parking kiosk or restaurant table might route through a legitimate-looking short URL before landing on a phishing page. The redirect gives a false sense of credibility.

Look for these warning signs at the final destination:

• The domain doesn't match the expected business. If you scanned a QR code at a parking meter and ended up at parkpay-now.com instead of your city's official parking portal, that's a mismatch. Legitimate operators always use their own official domain.
• The page asks for sensitive information immediately. A page that jumps straight to a login form, credit card field, or Social Security number entry — without context — is behaving like a phishing page. Legitimate services greet you with content first.
• The URL uses hyphens or misspelled brand names. Phishing domains often look almost right: venm0-pay.com, amaz0n-verify.net, or apple-id-secure.com. The redirect can't hide this — check the address bar after all redirects complete.
• No HTTPS padlock. Any legitimate payment or login page will use HTTPS. An http:// address on a page asking for sensitive data is a strong signal of fraud.
• More redirects than expected. One or two hops is normal. Five or six redirects — especially if they pass through ad networks or unfamiliar domains — suggests evasion techniques designed to bypass security tools.

What to do right now

If you landed on a suspicious page but didn't enter anything

Your risk is low. Simply close the tab and clear your browser history for that session. Check your browser's Downloads folder to confirm nothing was saved. Monitor your accounts over the next few weeks for unusual activity, but you likely don't need to take further action.

If you entered a password or login credentials

1. Change that password immediately on the real service (go directly to the official site — don't use another QR code).
2. Change the same password on any other account where you reuse it.
3. Enable two-factor authentication on the affected account if you haven't already.
4. Check the account's recent activity log for unfamiliar logins — most major services show this under security settings.

If you entered payment information

1. Call the number on the back of your card immediately and report potential card compromise. Ask for a replacement card number even if no charge has appeared yet.
2. Screenshot the final URL from your browser history — your bank's fraud team will want documentation.
3. Change passwords on any accounts where that card is saved (Amazon, Apple ID, Google, PayPal).
4. File a report at reportfraud.ftc.gov with the URL and any details about where the QR code was located.

If you downloaded a file or granted permissions

This is the highest-risk scenario. See our dedicated guide on what to do if a QR code downloaded something — it walks through how to check for malicious apps or profiles on both iPhone and Android, and when to do a full device reset.

How to check the redirect chain yourself

You don't need special tools. After a scan, open your browser's history to see the full sequence of URLs your browser visited. In Safari on iPhone, tap the book icon → History. In Chrome, tap the three-dot menu → History. You'll see each URL in the redirect chain listed separately.

For a deeper check, copy the final destination URL and paste it into Google's Safe Browsing checker or VirusTotal. These services cross-reference the URL against known phishing and malware databases and return a result within seconds.

If you want to preview where a QR code redirects before your browser opens it, that's exactly what QRsafer does — it resolves the full redirect chain and checks every hop against threat databases before anything loads on your phone.

Frequently asked questions