When not to scan a QR code

A QR code is just a web address you cannot read. That is the entire problem. Everything else follows from it.

Where they actually show up

Stuck over a real one. Parking meters, EV chargers and payment terminals are the classic targets. A printed sticker goes over the genuine code, pointing at a convincing payment page. The machine is real, the location is real, the code is not.

In an email or a letter. Increasingly common, because a QR code sails past the link-scanning that email providers apply to ordinary links. A letter claiming to be from your bank, with a code to "verify your account", is a scam in a format people have not learned to distrust yet.

On a menu or a poster. Usually genuine, occasionally not. The risk is low but the habit it builds — scan anything, trust whatever opens — is the actual damage.

In a delivery notice. A card through the door with a code to rearrange delivery. Same scam as the text message, different medium.

What to do instead

Look at the address before you act on it. Every phone shows the destination before opening it. Read it. The part immediately before the first single slash is the real site.

Look at the sticker itself. Peel-up corners, a code that sits crooked on the sign, a different paper finish. On a parking meter, take ten seconds to check.

Never enter payment details on a page you reached by scanning. Open the company's app, or type the address yourself. A parking app you already have is always the safer route.

Treat a code in an email like a link in an email. Which is to say: with suspicion, and never as a route to signing in.

If you are not sure

Our link checker takes the address a code resolves to and tells you what the domain actually is, without opening the page. Most phone cameras will show you the address; paste it in before you tap it.