Is the QR Code at Walgreens Safe to Scan? Quick Answer

Where Walgreens legitimately uses QR codes

Walgreens uses QR codes in several specific, well-defined places:

• myWalgreens rewards at checkout. The Walgreens app generates your personal myWalgreens barcode and QR code on the “Rewards” screen. You show it to the cashier or hold it up to the self-checkout scanner to apply points and offers. You are never asked to scan an external QR code to redeem rewards — the app is the source of truth.
• Prescription ready-for-pickup notifications. Walgreens may include a QR code in your pickup confirmation text or app notification that the pharmacy counter scans to pull up your order. This code comes from within the Walgreens app or a message that links back to walgreens.com. You show it; pharmacy staff scan it.
• Photo order pickup. When a Walgreens Photo order is ready, your confirmation email or app notification includes a QR code the associate scans at the photo counter or self-service kiosk. The destination is always walgreens.com or the in-store photo system.
• Curbside and in-store pickup confirmation. After placing an order on walgreens.com, a QR code in your confirmation email or app notification lets staff retrieve your order quickly. The destination is always walgreens.com.
• In-store promotional and product displays. These are the codes to watch. Counter cards, shelf tags, and signage throughout Walgreens stores often carry static QR codes for promotions, health screenings, and product information. Because they are static and publicly accessible, they are the easiest target for a sticker swap.

If the QR code fits one of those patterns and the destination starts with walgreens.com or photo.walgreens.com, you are safe.

The real risk: sticker QR code swaps on displays, kiosks, and counter cards

The scam is quick and low-tech. A bad actor prints a QR sticker that redirects to a convincing fake Walgreens login or payment page, then presses it over the legitimate code on a counter card, photo kiosk, or shelf display. The swap takes seconds and is easy to miss in a busy pharmacy or photo center. When the next customer scans, they land on a phishing page that asks for myWalgreens login credentials, payment details, or insurance information.

This is the same attack that targets pharmacies broadly — Walgreens is a high-value target because its stores handle prescription data, insurance details, and payment information, and tens of millions of customers visit each week with their guard down. Photo kiosks are an additional attack surface unique to Walgreens, since customers routinely scan codes and enter payment details at unattended self-service stations.

How to spot a swapped sticker before you scan

• Feel for a raised edge. Run your fingernail lightly across the QR code. If you feel a ridge or the code is slightly misaligned with the surrounding design, a sticker may have been applied on top. Don't scan — tell a staff member.
• Preview the URL before tapping. Your phone shows a link preview after decoding the QR before you open anything. Any URL that does not start with walgreens.com or photo.walgreens.com is a red flag. Close the browser without tapping.
• Use QRsafer first. QRsafer decodes the QR code and checks the destination against threat intelligence databases before your browser ever loads the page — a safety verdict in under a second.

What to do if you already scanned and something felt wrong

1. Close the page immediately — do not enter any information and do not tap any buttons on the suspicious page.
2. If you entered your myWalgreens login: go directly to walgreens.com and change your password immediately. Check your rewards balance and order history for any unauthorized activity. Enable two-step verification if you haven't already.
3. If you entered payment or insurance details: call your bank or card issuer right away to report potential fraud and request a replacement card. If health or insurance information was submitted, contact your insurer and consider placing a fraud alert with the credit bureaus.
4. Tell a Walgreens staff member. Point out the QR code on the display or kiosk. If it is a sticker swap, they can remove it immediately and protect every customer who comes in after you.
5. File a report at reportfraud.ftc.gov with any screenshots of the code and the page it opened. This helps authorities identify and shut down the phishing site.

Frequently asked questions