Check a QR code before you scan it
A QR code is just a link printed as a pattern of squares. That’s what makes it useful to scammers: you can read a written link before you tap it, as you did in Lesson 2, but nobody can read a QR code by looking at it. In this lesson you’ll turn QR codes back into plain text, read your camera’s preview before anything opens, and learn where fake codes turn up.
In this lesson
- Read where a QR code goes before your phone opens it
- Decode a QR code into plain text and read what’s inside
- Recognise the places fake QR codes are planted
You’ll need: a phone with a camera, and any QR code you can find at home: on a product box, a restaurant menu, a router sticker or a letter.
Where fake QR codes turn up
- Parking meters and pay stations. A sticker with a new code is put over the real one, and leads to a fake payment page. The FTC warned about this in September 2026.
- Text messages. A text with a state seal, a case number and a court date says you must scan a QR code to pay a traffic fine “to avoid court”. The FTC warned about these in April 2026. Every part of it is fake.
- Emails. A QR code in an email is a way round the filters that check links, because the filter sees a picture, not an address. “Scan to keep your account active” is a classic.
- Letters and posters. Anything printed can carry a code, and anyone with a printer can make one.
What they have in common: the code leads somewhere that asks you to pay, sign in or install something. The code itself can’t hurt your phone. The page it opens is the danger.
Try it yourself · part 1
Read the preview before anything opens
- Open your phone’s camera and point it at a QR code. Don’t tap anything yet.
- A small banner or button appears with a web address in it: on an iPhone it’s a yellow button just below the code; on most Android phones it’s a pop-up with the link. That’s the address the code contains.
- Read it the way you learned in Lesson 2: find the first single slash and read the domain to its left. Is it the company or council you expected?
- Only then decide whether to tap. If the preview shows a shortened link, a string of numbers, or a name you don’t recognise, don’t.
Try it yourself · part 2
Decode a code into plain text
The preview only shows part of the story. For a code you’re unsure about, or one that’s in a text or email on the same phone (which your camera can’t scan), decode it first:
- Take a photo of the code, or a screenshot if it’s on your screen.
- Open the QR Code Decoder and add the picture. It reads the code in your browser; the image isn’t uploaded anywhere, and nothing is opened.
- Read the verdict at the top. There are three:
- Do not scan: the code is disguising where it goes, for example a fake name in front of an @ sign, a lookalike domain, or hidden code.
- Check before acting: worth a second look, for example a shortened link that hides the real destination, a link to a bare number address, a link that isn’t encrypted, or a code that would make your phone join a Wi-Fi network, call a number or send a text.
- Nothing disguised: the code is what it looks like.
- Below the verdict, read the full contents. For a web address, find the domain yourself. Nothing disguised doesn’t mean the site is safe, only that the code isn’t hiding anything: a fake “traffic court” code pointing at
traffic-court-pay.topisn’t disguised at all, it’s just not a court.
What a real one usually looks like
| Where you found it | What to expect | Safer way to do the same thing |
|---|---|---|
| Parking meter or pay station | The council’s or parking company’s own domain, printed on the meter too | Pay through the official app, or the address printed on the signs, typed in yourself. Check the code isn’t a sticker stuck over the original. |
| Text about a fine, toll or court date | Real courts and transport agencies don’t usually collect fines through a QR code in a text | Look up the court or agency yourself and use its own website or phone number. In the US, real government sites end in .gov. |
| Restaurant menu or museum sign | The venue’s site, or a well-known menu service | Ask for a paper menu, or search for the venue’s site |
| Email asking you to “scan to verify” | Real companies almost never do this | Open the company’s app or site yourself and check there |
Key takeaways
- A QR code is a link you can’t read, which is why scammers like them.
- Your camera shows the address before opening it: read the domain first.
- The QR Code Decoder turns any code into plain text without opening it.
- “Nothing disguised” means the code isn’t hiding anything, not that the site is honest.
- For payments, fines and sign-ins, skip the code and go to the official site or app yourself.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. Why do scammers like QR codes?
2. The QR Code Decoder says “Nothing disguised” for a code in a text about an unpaid fine. Is it safe to pay?
3. You want to pay for parking and the meter has a QR code. What’s the safest option?
Next: emails, where the sender’s name is the easiest thing of all to fake.
This lesson is part of the free course Scams and Staying Safe, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.