How to Check If a QR Code Is Safe Before Opening Its Link

Check the Link Before You Open It

1. Scan without opening the result immediately. Use an Android Camera app or a QR reader that shows a link preview first. If your scanner opens links automatically, choose a method that lets you review the result before visiting it. If the code is in an image saved on your phone, see our guide to scanning QR codes from screenshots.
2. Read the complete website address. Check the actual domain, its spelling, and any unfamiliar words or endings. If the preview cuts off part of the address, use a scanner that lets you inspect the full decoded text without opening the link. A label printed beside the QR code is not proof of where it goes.
3. Consider the source. An unexpected message, mystery package, or sticker on public equipment deserves special caution. Even an official-looking sign can be altered.
4. Verify payment or login requests independently. Open the company's official app, type a website you already know, or call a trusted number instead of following the QR link.

When in doubt, don't open it. Checking the URL can reveal warning signs, but even a familiar-looking address does not prove the website is legitimate.

Find the Real Domain in the URL

A familiar company name inside a URL does not mean that company owns the site. Compare https://accounts.example.com, which is part of example.com, with https://accounts.example.com.verify-login.example, which belongs to verify-login.example.

These .example addresses are fictional. Watch for subtle spelling changes and shortened links that conceal a destination. If you cannot verify a link independently, do not use it for a login or payment. Even a correctly spelled address does not make an unexpected request trustworthy.

Warning Signs Around the Code

• Sticker placed over another QR code: Check parking meters, signs, and printed payment instructions for tampering. Use the provider's official payment app or website when unsure.
• Pressure to act immediately: Messages about missed deliveries, fines, suspicious account activity, or expiring rewards can be designed to rush you.
• Unexpected package or gift: A mystery QR code asking you to identify a sender, confirm an order, or claim a prize may lead to a phishing page.
• Surprise login, card form, or download: Don't enter passwords, financial details, or personal information just because a scanned code led to a convincing-looking page.

The Federal Trade Commission has documented QR sticker scams at parking meters and fraudulent QR links in messages. The safest alternative for a questionable code is to contact the organization through a separate, known channel.

Why a Successful Scan Doesn't Mean a Link Is Safe

No. HTTPS protects the connection to a website; it does not prove that the website belongs to the brand shown on the page. A phishing site can have a padlock and HTTPS, too.

Scanning a code only reveals its encoded data. ThinApps QR Code Scanner reads codes from the camera or a selected image and displays the exact scanned value for review. It never opens a link automatically: you must explicitly tap Open, which is enabled only for addresses that pass basic local URL-format checks. Those checks do not detect phishing, assess website reputation, or guarantee that a destination is trustworthy.

Android users who open links in Chrome can keep Google Safe Browsing enabled to receive warnings about sites identified as dangerous. The absence of a warning is not proof that every page is trustworthy.

If You Already Opened a Suspicious Link

• Only saw the QR preview: Close it without following the address. Decoding a URL is not the same as sending your password or payment details to the website.
• Opened the page but entered nothing: Close it, refuse unexpected downloads or permissions, and keep Android and your browser updated. Simply opening a page is generally less risky than submitting data, but the risk is not zero.
• Entered a password: Open the real service through its official app or a known address and change the password. Change reused passwords elsewhere and enable multi-factor authentication.
• Entered card details or paid: Contact your bank or payment provider through an official channel and review transactions for unauthorized activity.
• Installed an unfamiliar app: Remove it if possible, review the permissions you granted, and run Google Play Protect. Seek additional device-security help if suspicious behavior continues.

People in the United States can report scams to the FTC; elsewhere, use your local consumer-protection or cybercrime authority.