All guides · Privacy & security
How to check a QR code link before you open it
Short answer
- You cannot read a QR code by eye, which is why scammers use them to send people to fake sites. Look at the full address before you open the link.
- The real site is the part just before the first single slash. A familiar brand near the start means nothing if the address ends in a different domain.
- If a page opened from a QR code asks for a one-time code, card details or an app install, stop and go through the official app or a site address you type yourself.
How QR code scams work
People have learned to distrust links in text messages, but scanning a QR code and tapping the link still feels routine. Scams commonly take these forms:
- A fake QR sticker placed over the real one on a parking meter, bike rental stand or restaurant table.
- QR images in emails or letters pretending to be about a parcel delivery, a fine or a refund.
- Messages claiming your account needs a “security check”, with a QR code leading to a fake login page or an app download.
Finding the real domain in an address
In an address, the site name is everything after https:// and before the first single slash. Within that, the last two parts (for example example.com), or three for addresses such as example.co.uk, identify who owns the site; anything in front of them can be made up.
| Address | Actual site | Verdict |
|---|---|---|
| https://www.example.com/notice | example.com | Fine if example.com is the organisation you expect |
| https://example.com.login-check.top/ | login-check.top | A different site imitating the start of the name |
| https://examp1e.com/ | examp1e.com | A fake using the digit 1 instead of the letter l |
| A short link such as bit.ly/… | Unknown until opened | The destination is hidden, so be careful |
The padlock and https only mean the connection is encrypted. They do not mean the site is trustworthy; fake sites use https too.
Checklist before you open it
- Look at the code itself. If a QR code in a public place is a sticker on top of another, or its edges are peeling, do not use it.
- Read the whole address. Most phone cameras show the link before opening it. If it is cut off, press and hold to see all of it.
- Check that the domain belongs to the organisation. If you are not sure, skip the QR code and go to the official site or app directly.
- If you did open it, notice what it asks for. If you are not at a real checkout and it wants a card number or a one-time code, or it pushes you to install an app, close it.
Checking a QR code you received as an image
A QR code on your own screen is awkward to scan with the same phone. Save a screenshot or the image and open it in Read QR Code from Image to see what it contains without opening the link. The tool works like this:
- It shows the decoded content first and never opens a link automatically. You decide whether to click Open link.
- The Open link button appears only for addresses that start with http:// or https://. Anything else is shown as text you can copy.
- Addresses written as https://name:password@host, a trick that can disguise the real domain, are not treated as openable links and are shown as text instead.
- The image and its content are processed in your browser and are not sent to a server or an analytics service.
If you already opened it or entered details
- Change the password you typed on the real site straight away, along with any other account that uses the same password.
- If you entered card or bank details, call your bank or card issuer immediately using the number on your card or their official site, and ask them to block or monitor the card.
- If you installed an unknown app, remove it and have your phone checked before using banking apps again. You can also report the scam to your local police or national fraud reporting service.