Top tips: How can you tell if a QR code is safe?

Top tips is a weekly column where we highlight what's trending in the tech world and share practical ways to navigate these shifts. This week, we're discussing why it's time to think twice before scanning your next QR code.

When was the last time you questioned a QR code?  

QR codes have quietly become part of our everyday lives. A decade ago, they felt like a novelty. Today, they're everywhere. We scan them to order food at restaurants, pay for parking, access event tickets, connect to Wi-Fi, make digital payments, and even fill out forms. They've become so familiar that reaching for our phone and scanning one has become almost instinctive.

That convenience, however, comes with a hidden assumption: We trust QR codes without questioning them.

Most of us have learned to pause before clicking a suspicious email link or downloading an unknown attachment. Yet QR codes rarely receive the same scrutiny. Because they don't immediately reveal where they lead, we often assume they're safe simply because they're printed on a poster, placed on a restaurant table, or attached to a payment terminal.

Cybercriminals are taking advantage of that trust.

Security experts refer to this growing tactic as QR phishing, where attackers use malicious QR codes to redirect victims to fraudulent websites. Sometimes these codes are pasted over legitimate ones in public places, such as on parking meters or in restaurants. In other cases, they appear in emails or text messages, encouraging recipients to verify an account, claim a reward, or review a document. The objective is always the same: Convince someone to hand over sensitive information voluntarily or make a payment on a fake website.

The good news is that QR codes themselves aren't dangerous. Like any technology, they're only as trustworthy as the person who created them. Developing a few mindful habits can help you enjoy their convenience without falling victim to scams.

1. Start by trusting the destination—not the QR code  

A QR code is simply another way of opening a webpage, but unlike a traditional hyperlink, it doesn't tell you where you're going until after you've scanned it. Before tapping Open, take a moment to review the preview URL your phone displays.

Does the domain name match the business you're expecting? Are there unusual spellings, unfamiliar extensions, or extra characters that seem out of place? A few seconds spent verifying the destination can prevent you from landing on a convincing but fraudulent website designed to steal your credentials or payment information.

2. Pay attention to where the QR code appears  

Not every QR code you come across is the one the business originally placed there. One of the simplest yet most effective QR code scams involves placing counterfeit QR code stickers over legitimate ones. Parking meters, restaurant tables, payment kiosks, and public notice boards have all been targeted because people rarely stop to inspect the code before scanning it.

Before scanning a QR code, look closely. Does it appear tampered with? Is it pasted over another label? Does it seem out of place? If something feels unusual, verify it with the business or choose another payment method instead.

3. Slow down before you share your information  

Many QR code scams don't rely on sophisticated technology; they rely on urgency. A QR code may lead to a website asking you to log in, verify your account, update your payment details, or claim a reward. These requests are often designed to make you act quickly, leaving little time to question whether the website is genuine.

Whenever a QR code asks you to enter sensitive information or complete a payment, pause for a moment. Verify that you're on the organization's official website before proceeding. If you're unsure, navigate to the website manually instead of continuing from the QR code.

A safer scan starts with a simple question  

Technology often becomes safest when we stop taking it for granted. QR codes are no different. Their convenience has changed the way we interact with the world, but it has also changed the way attackers approach their victims.

The next time you scan a QR code, take a moment to ask yourself one simple question:

Do I know where this is taking me?

That small pause may be all it takes to protect your personal information, your accounts, and your money.