Skip to content
kizmo

How to tell if a QR code is safe before you scan

Updated · 5 min read

Short answer

Check whether the code is a sticker placed over something else, read the web address your camera shows before opening it, avoid short links that hide the destination, and never enter payment or login details on a page reached from an unexpected code. When in doubt, run it through a QR safety checker.

Seven checks

  1. Physical check. Run a finger over the code. A sticker on top of printed signage is the most common sign of fraud.
  2. Context check. Does it make sense for this code to be here, asking for this?
  3. Address check. Your camera shows the destination before opening it. Read the domain, not just the start of it: paypal.com.pay-now.top is not PayPal.
  4. Spelling check. Look for swapped letters and numbers: paypa1, arnazon, parkmobi1e.
  5. Short-link check. Short links hide where you are going. Unmask them with a checker.
  6. Request check. A menu should not ask for your card. A parking meter should not ask for your email password.
  7. Pressure check. Countdown timers, fines that double today, and "verify now" warnings are pressure tactics.

Use a checker

The free Kizmo QR safety checker decodes a photo or screenshot of a code in your browser, follows every redirect without opening the page, checks how old the domain is, and flags brand look-alikes. If it is a Kizmo code, it also shows who registered it and when its destination last changed.