How to Check if a QR Code Is Safe Before Scanning

This advice mirrors what the FTC's own consumer alert on QR code scams recommends: inspect the URL a code leads to before you open it, and treat unexpected codes with suspicion.

Level 1: Use your phone's built-in preview

Both iPhones and Android phones show you the destination link before opening it — this is your fastest, always-available first check.

• iPhone: open the standard Camera app and frame the QR code. A banner appears at the top showing the URL — read it before tapping.
• Android (stock/Pixel): open the Camera app or Google Lens and frame the code. A preview chip shows the link — tap and hold rather than tapping straight through.
• Samsung phones: the default Camera app's "Scan QR codes" toggle (in Camera settings, or via Bixby Vision) behaves the same way — a preview appears before the browser opens. If it's disabled, enable it rather than relying on a third-party scanner app of unknown origin.
• Older Android phones without built-in scanning: if your Camera app doesn't detect QR codes at all, use Google Lens (a standalone app on the Play Store) rather than an unfamiliar third-party "QR scanner" app — many of these apps have a poor security track record themselves.

Level 2: Read the domain carefully

If the preview shows a full domain (not a shortened link), take a moment to actually read it rather than skimming it. Ask:

• Does this domain match the business or organization I'd expect? (A real parking app isn't going to be hosted on a random unrelated domain.)
• Are there subtle misspellings, extra words, or unusual endings (.xyz, .top) that a real brand wouldn't use?
• Is it a URL shortener (bit.ly, tinyurl, etc.)? If so, you genuinely can't tell where it leads without unshortening it first.

Level 3: Run an actual safety check

For anything that isn't obviously trustworthy — an unfamiliar code in public, an unexpected one in an email, or a shortened link — the most reliable step is checking the destination against real threat data before visiting it. CheckThisQR also automatically resolves shortened or redirecting links to their real final destination as part of this check — see our methodology page for exactly how.

Decision table: what to do, by scenario

Situation	Risk level	What to do
QR code on a menu at a sit-down restaurant, staff-provided	Low	Preview the link (Level 1) — generally fine to proceed.
QR code on a parking meter or public sticker	Medium	Check for physical tampering first (see our sticker guide), then run a full check (Level 3) before paying.
QR code in an unexpected text or email	High	Treat as suspicious by default. Don't scan unless you independently verify the sender through another channel.
QR code shortened via bit.ly/tinyurl in any context	Medium	Always run a full check (Level 3) — you cannot evaluate a shortened link by sight.
About to enter a password or payment info after scanning	High	Always run a full check first, regardless of source — this is the exact moment attackers count on you skipping it.

Related guides

• How to Spot a Fake or Tampered QR Code StickerScammers stick fake QR codes over real ones. Learn the physical warning signs to check before you scan a parking meter, menu, or poster.
• Scan a QR Code from a Photo — Safe and PrivateUpload a screenshot or photo of any QR code. It decodes in your browser, so the image itself never leaves your device.
• How Google Web Risk Works: QR Safety Checks ExplainedA technical look at the threat database behind our checks: how it's built, how quickly it updates, and what that means for false positives and negatives.