How to Check If a QR Code Is Safe Before Scanning

QR codes are everywhere: parking meters, restaurant tables, parcels, posters, even the emails in your inbox. That's exactly why scammers like them. You can't read a QR code with your eyes, so a fake one looks just like the real thing.

What is quishing?

Quishing (QR code phishing) is when a scammer hides a malicious link inside a QR code. The goal is the same as any phishing attack: to get you onto a fake page where you type a password, pay a "fee", or download something harmful.

QR codes give scammers two advantages over ordinary links:

• You can't see the destination. A printed URL can be read and judged. A QR code is just a pattern of squares until you scan it.
• They move you to your phone. A QR code in an email asks you to switch from your work computer, which may have security filters, to your personal phone, which probably doesn't. Mobile browsers also show less of the address bar.

The US Federal Trade Commission has warned consumers that scammers hide harmful links in QR codes. Its advice: check the URL before you open it, and don't scan codes that show up unexpectedly in emails or texts.

Common QR code scams

Red flags in the link itself

Once you can see the decoded web address, these are the patterns that should make you stop:

1. A misspelled or lookalike domain

Scammers register domains that differ from the real one by a single character: paypa1.com, amaz0n-support.com, citypark-pay.net. The part that matters is what comes just before the first single slash. In https://yourbank.com.secure-login.co/ the real domain is secure-login.co, not your bank.

2. Lookalike characters (punycode)

Some domains swap Latin letters for identical-looking letters from other alphabets, such as a Cyrillic "а" instead of an English "a". Browsers often show these domains in a form starting with xn--. If you see xn-- in a domain you thought you recognised, it isn't the site you think.

3. A link shortener

Shorteners like bit.ly or tinyurl.com are used legitimately all the time, but they also hide the real destination. From an unknown source, a shortened link is a reason for extra care, not a guarantee of danger.

4. A raw IP address

A link like http://185.12.44.9/pay points to a server number instead of a domain name. Legitimate businesses almost never send customers to bare IP addresses.

5. Hidden login details in the URL

A link such as https://yourbank.com@evil.example/ looks like your bank, but everything before the @ is treated as a username. The browser actually goes to evil.example. This is an old trick that still works on people.

6. No HTTPS

A page that asks for passwords or payment should always use https://. Note that HTTPS only means the connection is encrypted, not that the site is honest. Plenty of scam sites have valid HTTPS too.

How to check a QR code safely, step by step

1. Look at the code physically. Is it a sticker on top of printed material? Is the edge peeling, or does it look added later? Tampered stickers are the most common real-world attack.
2. Ask whether you expected it. A QR code on a restaurant table you're sitting at is normal. A QR code in an unexpected email about your account is not.
3. Decode it without opening it. Your phone's camera usually shows a preview of the domain. Read it before tapping. For a full view, upload a photo or scan with Jabble's QR code scanner. It decodes the code in your browser, shows the complete link and the destination domain, and never opens anything automatically.
4. Check the red flags above: spelling, xn--, shorteners, IP addresses, an @ in the link, and no HTTPS. Jabble's scanner flags each of these for you.
5. When in doubt, go direct. Instead of following the code, type the company's known web address yourself or use its official app.
6. Never enter sensitive information straight from a scan unless you're confident about the domain. That means passwords, card numbers, or one-time codes.

What to do if you scanned a bad code

Scanning a QR code on its own just reads text. The risk comes from what happened next. Act based on what you did:

• You only opened the page: close the tab. If it asked to send notifications and you allowed it, remove that permission in your browser settings.
• You entered a password: change it straight away on the real site, change it anywhere else you've reused it, and turn on multi-factor authentication.
• You entered card or bank details: call your bank using the number on the back of your card and ask them to block the card and watch for fraudulent charges.
• You installed an app or profile: uninstall it, check for any unknown device-management profiles, and update your phone's operating system.
• Report it. Tell the business whose code was tampered with, such as the car park operator or the restaurant, so they can remove it. In the US you can also report scams to the FTC at ReportFraud.ftc.gov.

For businesses: protect your own QR codes

If customers scan your codes, scammers can target your customers. A few habits make tampering much harder:

• Print codes into the material rather than using stickers where you can, so a fake sticker on top is obvious.
• Brand the code. A frame with your logo and a line like "Scan to view our menu at yourcafe.com" tells customers which domain to expect.
• Use your own domain or a trusted link so the preview customers see matches your business.
• Check your codes regularly. Staff can scan each code during opening checks. Dynamic codes with scan analytics also help, because a sudden drop in scans can mean someone has covered yours.