Check QR Code Destinations Before Logging In or Paying
Inspect the destination URL and verify unexpected payment or account requests through official channels.
What is the problem?
A QR code makes a web address easy to share, but that does not prove the destination is trustworthy. A sticker or unexpected message may lead to a convincing lookalike payment or login page.
Step-by-step solution
Inspect the URL before opening the destination
The US FTC warns that deceptive QR codes can hide spoofed links. Review the displayed hostname and look for spelling changes before proceeding.
Verify urgent requests outside the QR message
If a text or email claims an account is blocked or demands an immediate fee, independently open the company's known website or app instead of trusting the code.
Do not enter credentials on suspicious pages
Close unfamiliar sign-in or payment pages and confirm account status through the provider's official route. Treat unsolicited app-install prompts as another warning sign.
Alternative method
Type the official company address yourself or navigate inside its authenticated app instead of scanning an untrusted code.
Known limitations
A legitimate-looking URL can still lead to compromised content, and shortened links can obscure where users are sent. One visual inspection cannot eliminate every threat.
Frequently asked questions
No. A successful scan only means the code was decoded. Verify the actual destination and the actions it asks you to take.
Official primary sources
This article uses the official references below; consult them for the full guidance.
