Is this QR code safe?
Scan the code or upload a photo of it. The checker shows where the code leads and points out warning signs of a scam, without opening the link. It runs on your device.
Drop an image here or paste it
Result
The check reads only what is in the code and never opens the link, so “no warning signs” does not prove a page is safe. Don’t enter passwords or card details on a page you reached through a QR code on a sticker, flyer, letter or email. How QR code scams work
Make a new code that holds the real destination, the address of your own page. We don’t open the short link, so we can’t see where it leads.
Make a permanent codeAlready printed? In the Print dialog, choose “Cover-up sticker” to print the new code a little larger than the old one and stick it over it.
Swiss QR-bill
Reissue with a structured address
Opens the QR-bill generator with this bill filled in. The data stays in your browser.
Before you pay, compare the name and account with the invoice or the shop. Scammers sometimes stick their own codes over real ones.
Make your own payment codeCheck the address before you open it. A QR code can point anywhere.
What the check looks at
- Where the link really goesThe checker shows the domain the page is on. That is the part to compare with the company you expect: “paypal.com.secure-help.net” is on secure-help.net, not on paypal.com.
- Imitated brand namesAddresses that copy a well-known name with a changed letter or digit (paypa1, rnicrosoft), or that put a brand name on someone else’s domain. The check knows the domains of banks, payment and parcel services, parking apps and large online services that scams often imitate.
- Addresses that hide somethingBare numbers instead of a name, an “@” that makes the browser ignore the first part, letters from other alphabets, unusual ports, short links that hide the destination, and free hosting where anyone can publish a page or form.
- What the page asks forLinks to sign-in, verification or password pages, files that install apps or programs, cryptocurrency payments and text messages to short numbers that can be premium-rate.
- Payment codesSEPA, Swiss QR-bill and Pix codes are shown field by field: name, account and amount. Compare them with the invoice or the sign before you pay.
Common QR code scams
- Stickers on parking meters and charging stationsA fake code is stuck over the real one and leads to a payment page that copies a parking app. Pay through the official app or the meter itself, and look for a sticker on top of the printed code.
- QR codes in emails (“quishing”)An email says your password expires or a document is waiting, and asks you to scan a code. A code hides the link from email filters and moves you to your phone, where the address is harder to check.
- Fake delivery notices and finesA card in the letterbox or a letter about a missed parcel, a parking fine or a tax refund, with a code to “pay the fee” or “confirm your details”. Look up the company yourself instead of scanning.
- Swapped payment codesA code on an invoice, a donation sign or a restaurant table is replaced with one that pays someone else. The name and account in the code then do not match the business.
- App downloadsA code offers an app from outside the official store, often for parking, payments or a “security update”. Install apps only from the App Store or Google Play.
Warnings about these scams: FBI (2022) and US Federal Trade Commission (2023).
Before you scan or pay
- Look for a stickerOn meters, signs and posters, run a finger over the code. A sticker on top of a printed code is a reason to stop.
- Read the domainBefore the page opens, read the domain, not just the start of the address. If it is not the company you expect, don’t open it.
- Don’t sign in or pay through a codeOpen the bank, parking or delivery app yourself, or type the address you know. A code is a shortcut to a page, not proof of who runs it.
- Check payment detailsFor payment codes, compare the name, account and amount with the invoice before you confirm.
Questions
- Can a QR code hack my phone just by scanning it?
- Scanning only reads text, usually an address. The risk is what you do next: opening a fake page and entering a password or card number, installing an app, or paying the wrong account. That is why the checker shows the content before anything opens.
- Does the checker open the link?
- No. It reads the code on your device and looks only at the text inside it. Nothing is uploaded, opened or sent, so it cannot see what the page shows or where a short link leads.
- The checker found no warning signs. Is the link safe?
- Not necessarily. A scam page can sit on an ordinary-looking new domain. No warning signs means only that the address shows none of the common tricks. Still check that the domain belongs to the company you expect.
- Why does it warn about a short link?
- A short link or a dynamic QR code service forwards you to another address that you can’t see until the page opens. Many honest businesses use them, but they also hide scam pages. If you trust the business, it is fine; if the code came from a sticker or an unexpected letter, be careful.
- I already entered my details on a page from a QR code. What now?
- Change the password on the real site, and turn on two-step sign-in. If you entered card or bank details, call your bank on the number on your card. Report the code to the owner of the meter, sign or shop it was on.
- How can I tell if a QR code was replaced?
- Look for a sticker over a printed code, a code that looks newer than the sign, or a payee name that doesn’t match the business. Scan it here: the checker shows where the link leads, and for payment codes, the name and account.