Is the QR Code at CVS Pharmacy Safe to Scan? Quick Answer

Where CVS legitimately uses QR codes

CVS uses QR codes in several specific, well-defined places:

• ExtraCare rewards at checkout. The CVS app generates your personal ExtraCare barcode and QR code on the “Card” screen. You show it to the cashier or hold it up to the self-checkout scanner. You are never asked to scan an external QR code to use your rewards — the app is the source of truth.
• Prescription ready-for-pickup notifications. CVS may include a QR code in your pickup confirmation that the pharmacy counter scans to pull up your order. This code comes from within the CVS app or a text that originates from a cvs.com shortlink. You show it; pharmacy staff scan it.
• MinuteClinic digital check-in. CVS MinuteClinic uses QR codes at kiosks and in confirmation messages to verify walk-in or scheduled appointments. These codes resolve to minuteclinic.com, which is operated by CVS Health.
• Curbside and in-store pickup confirmation. After placing an order on cvs.com, a QR code in your confirmation email or app notification lets staff retrieve your order quickly. The destination is always cvs.com.
• In-store promotional and product displays. These are the codes to watch. Counter cards, shelf tags, and signage throughout CVS stores often carry static QR codes for promotions, health screenings, or product information. Because they are static and publicly accessible, they are the easiest target for a sticker swap.

If the QR code fits one of those patterns and the destination starts with cvs.com or minuteclinic.com, you are safe.

The real risk: sticker QR code swaps on displays and counter cards

The scam is quick and low-tech. A bad actor prints a QR sticker that redirects to a convincing fake CVS login or payment page, then presses it over the legitimate code on a counter card or shelf display. The entire swap takes seconds and is easy to miss in a busy pharmacy. When the next customer scans, they land on a phishing page that asks for ExtraCare login credentials, payment details, or insurance information.

This is the same attack that targets pharmacies broadly — CVS is a high-value target because its stores handle prescription data, insurance details, and payment information, and millions of customers visit daily with their guard down.

How to spot a swapped sticker before you scan

• Feel for a raised edge. Run your fingernail lightly across the QR code. If you feel a ridge or the code is slightly misaligned with the surrounding design, a sticker may have been applied on top. Don't scan — tell a staff member.
• Preview the URL before tapping. Your phone shows a link preview after decoding the QR before you open anything. Any URL that does not start with cvs.com or minuteclinic.com is a red flag. Close the browser without tapping.
• Use QRsafer first. QRsafer decodes the QR code and checks the destination against threat intelligence databases before your browser ever loads the page — a safety verdict in under a second.

What to do if you already scanned and something felt wrong

1. Close the page immediately — do not enter any information and do not tap any buttons on the suspicious page.
2. If you entered your CVS login: go directly to cvs.com and change your password immediately. Check your ExtraCare balance and order history for any unauthorized activity. Enable two-step verification if you haven't already.
3. If you entered payment or insurance details: call your bank or card issuer right away to report potential fraud and request a replacement card. If health or insurance information was submitted, contact your insurer and consider placing a fraud alert with the credit bureaus.
4. Tell a CVS staff member. Point out the QR code on the display. If it is a sticker swap, they can remove it immediately and protect every customer who comes in after you.
5. File a report at reportfraud.ftc.gov with any screenshots of the code and the page it opened. This helps authorities identify and shut down the phishing site.

Frequently asked questions