The short answer: QR codes remove the visual pause people often use to inspect a link. Stickers can also be placed over legitimate codes on parking meters, menus and payment signs.
A QR code hides a destination rather than proving it
The useful move is to separate what the claimant controls from evidence you can obtain independently. Names, logos, caller ID, screenshots and a polished page can all be copied. A saved telephone number, a typed official address, a known colleague or a protected transaction route changes the channel instead of merely inspecting the same claim again.
Risk also depends on consequence. Reading a public page is different from granting remote access, sending an identity document or approving an irreversible payment. As the cost of error rises, require stronger verification and prefer a step you can undo.
Before opening a destination, the link safety preview can expose the hostname and path without visiting the page.
Warning signals to assess together
These clues become useful when they form a pattern. Treat each one as a prompt to verify, not as a verdict by itself.
A physical sticker looks newer than the surface around it
Pair this observation with a separate check: Preview the URL before opening it.
The destination asks for an app download or unusual payment
Pair this observation with a separate check: Use the venue's app or typed website for payment.
The domain does not match the operator shown nearby
Pair this observation with a separate check: Report altered physical signage to the operator.
Do not use one clue as a verdict: A QR code is only an encoding format. Its safety depends on the destination and the requested action.
Inspect a QR code destination before opening it
Keep the verification route separate from any contact detail or instruction supplied in the questionable message.
Preview the URL before opening it
This step tests the related concern: A physical sticker looks newer than the surface around it.
Use the venue's app or typed website for payment
This step tests the related concern: The destination asks for an app download or unusual payment.
Report altered physical signage to the operator
This step tests the related concern: The domain does not match the operator shown nearby.
Decide what to do after verification
If the independent channel confirms the identity and request, ask whether the proposed method still gives you a record and recourse. Legitimate people and organisations should tolerate a proportionate verification step. Resistance, secrecy or a demand to bypass normal controls is new evidence, not an inconvenience to ignore.
If the evidence remains mixed, reduce exposure: do not send original documents when a redacted copy is enough, do not pay a deposit before verifying authority, and do not approve access broader than the task requires. “Not yet” is a valid decision when the missing fact matters.
The same tactic appears in the public Wi-Fi risk guide, but the safest independent check changes with the channel.
What this verification cannot establish
This guide cannot authenticate a specific person, account, website or transaction. Interfaces and attack methods change, and legitimate situations sometimes contain unusual details. For an active loss, account compromise or safety threat, contact the relevant institution or official reporting service through a verified route.
Official sources and further guidance
These primary sources support the topic and provide current reporting or technical guidance. Availability and procedures can differ by country.
- Scammers hide harmful links in QR codesUS Federal Trade Commission
Reviewed by the Trust You Editorial Desk on 2026-10-08. We assess title-to-H1 alignment, independent verification steps, limitations and overlap with existing coverage. Request a correction.