Is the QR Code at Target Safe to Scan? Here's the Quick Answer

Where Target legitimately uses QR codes

Target uses QR codes in several well-defined places across its stores and digital channels:

• Target Circle loyalty kiosks. In-store kiosks and app screens display QR codes so cashiers can scan your rewards at checkout. These are generated inside the Target app and always link back to target.com or app deep-links — not third-party URLs.
• Price tags and product shelf labels. Some shelf tags carry a QR code that links to the product's target.com listing, reviews, or the Target app product detail page. Legitimate codes always resolve to target.com.
• Endcap and promotional signage. Seasonal and promotional displays may include QR codes linking to campaign landing pages on target.com. These are the most physically accessible codes — and the easiest for a bad actor to tamper with using a sticker.
• Email and app notifications. Target sends promotional emails containing QR codes for coupons or offers. Legitimate Target emails come from addresses ending in @target.com and QR codes inside them resolve to target.com. Any other sender domain is a red flag.
• Paper coupons and flyers. In-store flyers and weekly-ad inserts sometimes include QR codes for digital coupons. These are a higher-risk surface because counterfeit Target coupons are a known fraud vector.

The three scenarios — and their real risk level

1. In-store QR codes on shelf tags, endcaps, and kiosks — low risk

QR codes embedded in official Target displays are generated and managed by Target. The risk is physical tampering — a bad actor places a pre-printed sticker over the real code in seconds. This is the same attack seen at grocery stores and Walmart. Before scanning, run your fingernail lightly over the code — a raised edge or misalignment suggests a sticker has been applied. The URL preview after scanning should begin with target.com. If it doesn't, close the browser immediately.

2. QR codes in emails or texts claiming to be from Target — moderate to high risk

Phishing messages impersonating Target are common. They arrive as emails ("Your Target order has shipped — scan to track"), texts ("Your Target account is locked — verify now"), or fake coupon promotions. The QR code inside leads to a convincing fake login or payment page that harvests your credentials or card details.

Before scanning any QR from a message claiming to be Target: check that the sender's email domain is exactly @target.com (not target-deals.com, target-rewards.net, or anything similar). When in doubt, go directly to target.com or the Target app instead of scanning.

3. Paper coupons and flyers with Target QR codes — moderate risk

Counterfeit Target coupons are a recognized fraud vector. Fake coupons circulate on social media and in parking lots with QR codes that redirect to data-collection or payment-harvesting sites. Real Target digital coupons are clipped inside the Target app or at target.com/circle — they are not distributed as standalone printed QR codes in unofficial flyers.

If a coupon or flyer looks unofficial — no address, no expiration date, urgency language like "scan now before it expires" — skip scanning and go to Target.com/circle directly to see current offers.

The one-second check before you scan

After your phone decodes a QR code, it shows a URL preview before opening the browser. Glance at it — the address should begin with target.com (or a Target app deep-link starting with target://). If the URL looks unfamiliar, has a hyphen or extra words in the domain (target-deals.com, gettarget.com), or uses a link shortener, close the prompt and don't scan.

• Use QRsafer. QRsafer reads the QR code and checks the destination URL against threat intelligence before your browser loads anything — giving you a safety verdict in under a second, even for shortened or redirected links.
• Check for sticker overlays. Lightly touch the QR code surface. A sticker feels slightly raised at the edges compared to a printed code.
• Verify the sender domain. For emails and texts, confirm the message comes from an @target.com address before trusting any QR code inside it.

What to do if you already scanned and something felt off

1. Close the page immediately without entering any credentials or payment information. Do not tap any buttons on the suspicious page.
2. If you entered your Target login: go to target.com and change your password right away. Check your Target Circle account and recent orders for any unauthorized activity. Enable two-factor authentication if available.
3. If you entered payment details: call your bank or card issuer immediately to report potential fraud and request a card replacement. Credit card disputes are covered under the Fair Credit Billing Act.
4. Tell a Target team member. Point out the QR code on the display. If it's a sticker swap, they can remove it and protect other shoppers.
5. File a report at reportfraud.ftc.gov with any screenshots of the code and the page it opened. Reports help the FTC track scam patterns.

Frequently asked questions