How to check a QR code safely
A QR pattern does not reveal whether its destination is trustworthy. Preview the result and verify the site before sharing information.
Treat the code as an unknown link
A QR code can point to a legitimate page, a look-alike sign-in page, or a payment destination chosen by someone else. A familiar logo or a printed sign does not prove who created the code.
Use a scanner that displays the decoded destination before opening it. Check the full domain for swapped letters or extra words, and do not proceed if the address differs from the organization you expected.
Pause when a code creates urgency
Be cautious of unexpected QR codes in text messages or emails that threaten account closure, claim a delivery problem, or demand immediate payment. Contact the organization through a known app, website, or phone number instead of the instructions in the message.
For public signs, look for stickers placed over the original code or other signs of tampering. If something seems wrong, do not scan it; use an official payment or information channel.
Do not hand over credentials blindly
A decoded link is only a destination preview. It does not verify the page or protect information you enter there. Close pages that ask for unexpected passwords or payment details, and use your normal security steps if you already entered sensitive information.