QR codes have become a normal shortcut between the physical and digital worlds. Businesses use them for menus, payments, event registration, product information, and sign-in. Their convenience can also hide a basic fact: every QR code points somewhere, and the destination may not be trustworthy.
Unlike a printed web address, the destination is not always visible before someone scans. A fraudulent code can lead to a convincing copy of a login or payment page. Codes sent in unexpected emails, texts, packages, or invoices deserve the same suspicion as an unfamiliar link.
Before opening the destination, check the preview shown by the phone. Look for misspellings, unrelated domains, unusual shortened links, or a site that does not match the business named in the message. If the request is unexpected or urgent, use a known website or phone number to verify it independently.
Be especially careful when the code asks for a password, payment, banking details, or personal information. A legitimate-looking page is not proof that the code was legitimate. Navigate to the service through its official app or a saved address instead of continuing from the scan.
Businesses that publish QR codes should protect the physical placement. Check printed signs, counters, parking instructions, and event materials for stickers placed over the original code. Use tamper-resistant placement where practical and give customers a readable web address as an alternative.
Keep control of the destination as well. Use a company-owned domain, document who can change redirects, and remove outdated campaigns. Test codes periodically so customers do not land on expired pages, broken forms, or domains the business no longer controls.
Train staff to report suspicious codes without embarrassment. If someone entered credentials after scanning, change the affected password, end active sessions, enable strong multifactor authentication, and notify the person responsible for security or IT. Fast reporting limits damage.
The square pattern is only a delivery method. Apply the same habits you use for links: inspect, verify, and avoid entering sensitive information when the destination is uncertain.
Not sure what your website should be asking people to do?
Let's figure it out →