How to scan a QR code safely: check the link before you open it
After you scan a QR code, do not tap straight through. Read the domain the link really goes to first. QR scams, sometimes called quishing, send people to fake pages that ask for logins or payment details, and Korea's government, for one, advises people to check the address before scanning. A few seconds of reading catches most of the obvious tricks.
Where do I look in the address?
The part after https:// and before the first / is where you are going, and the end of that part is the real domain. A familiar name at the front means nothing if the end is different. The QR code scanner shows that real domain in large type. These results come from running each address through the scanner's checks (example domains):
| Scanned address | Where it really goes | Scanner warnings |
|---|---|---|
https://mybank.com.secure-login.example/verify | secure-login.example | Front dressed up as another site; login words |
https://www.example.com@evil.example/ | evil.example | Everything before @ is decoration; it goes to what follows |
http://192.168.0.10/login | 192.168.0.10 | No encryption; IP instead of a domain; login words |
https://bit.ly/3abcXYZ | bit.ly | Link shortener: the destination is hidden until opened |
https://xn--80ak6aa92e.example/ | xn--80ak6aa92e.example | Punycode: look-alike letters are possible |
https://exa%6Dple.com/ | example.com | %-encoded characters in the domain |
https://example.com:8443/pay | example.com | Unusual port number |
tel:+1-900-555-0100 | Phone call | Premium-rate number |
Swipe the table sideways
Which warning signs does the scanner check?
- Unencrypted
httplinks - Link shorteners, which hide the real destination
- An IP address instead of a domain
- Punycode (
xn--) or %-encoded domains that can disguise letters - An
@early in the address that hides the real domain - A piece that looks like another site's name placed in front of the real domain
- Words like login, verify, account, password, payment or bank
- Unusual port numbers and premium-rate phone numbers
- Types that should never be opened, such as
javascript:(no open button at all)
The scanner never opens a link by itself. It opens in a new tab only when you tap "Open this link". The camera feed and uploaded images are read inside your browser and are not stored or sent.
No warnings means it is safe?
No. No warning only means there are no obvious signs. If an unfamiliar domain asks you to log in, pay or verify your identity, do not type anything on that page. Open the official app or type the official address yourself and check from there.
A quick routine for every scan
- Do not tap the first prompt. Read the address your phone or scanner shows, all the way to the end.
- Check that the real domain matches the business or organization you expect.
- If it is a short link and you cannot see the destination, skip it unless it really matters.
- If the page asks for a login or payment, stop and use the official app instead.
- Look at the code itself: if it is a sticker stuck over another printed code, take a second look.
If you are the one putting up the code
Make it easy for people to trust what they see. A field guide on DEV Community recommends pointing your code at an intermediate address you control rather than at a final destination. Put a link on your own domain, with your business name in it, inside a static code, and people see your name instead of an unfamiliar short link. The difference between static and dynamic codes is explained in Do QR codes expire?
Sources
- Korea.kr policy briefing: check the address before scanning (in Korean) (Last checked September 28, 2026)
- DEV Community: Trustworthy QR codes, a field guide (Last checked September 28, 2026)