How to scan QR codes safely: 10 ways to avoid QR code scams

QR codes are part of our day-to-day lives. They help us access restaurant menus, make payments, join Wi-Fi networks, open websites, and even find detailed product information with a single scan. However, this convenience has also created a lot of opportunities for scammers.

While the QR code itself is not a scam, it can redirect you to a fake website, a phishing page, a fraudulent payment form, or a malicious download designed to steal your confidential information. Unlike a regular link, a QR code can hide its destination until you scan it, making it harder for you to identify it. This has led to a form of QR-based phishing known as quishing.

That’s why I worked with our Cybernews research team to create this detailed guide on how to stay safe while scanning QR codes. You’ll also find 10 tips that will help you detect and avoid QR code scams and see how Bitdefender’s all-in-one plans can also help you with this.

What is a QR code scam?

A QR code scam, also known as quishing, refers to an online fraud that uses the QR code to redirect you to a malicious or fraudulent website. Scammers usually place fake QR codes on parking meters, posters, restaurant menus, emails, and other places where legitimate QR codes are common. Thus, the risk doesn’t come from the QR code, but the website or action it leads you to.

For example, a scammer could replace a legitimate payment QR code with one that takes you to a fake payment page. The page looks like the real service and requests your card details, password, and other personal data.

Ultimately, there are a number of reasons why scammers create QR code scams. These include:

• Stealing login credentials through fake sign-in pages
• Collecting payment information through fake checkout forms
• Installing malware through malicious downloads
• Redirecting payments to malicious actors
• Stealing personal information like your name or address
• Promoting fake apps that may collect data or contain malware
• Running fake promotions or giveaways that request personal or payment details

QR code scam: a breakdown of the process

A QR code scam is a relatively simple process. I break it down so you can understand how it works more easily:

1. Scammers create or replace a QR code. Scammers put fake QR codes in places where you expect to find legitimate ones, such as posters, parking meters, emails, social media posts, and payment terminals.
2. You scan the QR code. When you scan the code, your phone reads it and opens the linked website. Keep in mind that the QR code doesn’t immediately harm your device. The main risk is the website it redirects you to.
3. The QR code opens a malicious website. These websites usually look legitimate, just like a bank, delivery company, retailer, or other service. That’s because scammers copy real logos, colors, and even page layouts to make the site look trustworthy.
4. The website requires you to take an action. You’ll be asked to provide your password, card, and any other personal information. You may also need to download an app, claim a fake price, or complete some verification process.

Actual locations where you can find QR code scams

Knowing where scammers put QR codes can help you potentially spot them before scanning them. Let’s see what these places could be:

• Public places. The most common public spots for fake QR codes are busy locations, such as public transport stops, event venues, charging stations, parking meters, and posters.
• Emails and text messages. Scammers can also send QR codes directly to your phone or email. Such messages may claim that you need to confirm a delivery, fix a failed payment, verify your account, or respond to a security warning. They create urgency for you to act quickly without focusing on details and checking if the request is legitimate.
• Websites and social media. Such QR codes can appear in online ads, social media posts, and websites. More precisely, scammers use them to promote fake giveaways, special offers, or cryptocurrency deals, and they often lead to malicious websites or downloads.
• Unexpected packages. Ultimately, you may receive an unexpected package with a QR code that requires you to scan it for delivery details, a refund, or a supposed prize. However, it’s crucial to avoid scanning the code if you don’t recognize the sender or you weren’t expecting a package, at least until you can verify who sent it.

How can you stay safe while scanning QR codes? 10 expert tips

Although QR codes are not a scam on their own, you need to be careful when scanning them. But don’t worry, as I’ve provided 10 tips that can help you stay safe and avoid QR code scams.

1. Check the origin of the QR code

Before you scan a QR code, make sure to ask yourself a few questions that can tell you where it came from, such as:

• Why is it there and who provided it?
• Did you expect to receive it?
• Is it displayed by a business you recognize?
• Does the surrounding message or sign look legitimate?

However, pay attention especially to QR codes in emails, SMS, packages, and ads. If the message asks you to scan the code to claim a refund, fix an account problem, or receive a prize, it could be an immediate red flag.

If you’re still not sure why you need to scan the code, don’t scan it until you verify the request through the supposed company’s official source.

2. Look for signs that may reveal if someone tampered with the QR code

Always check the QR codes in public places before scanning them. This can help you detect whether the scammer placed the sticker above a legitimate one. So, make sure you focus on things like:

• A sticker covering another QR code
• A sticker that is poorly aligned
• Branding that doesn’t match the rest of the sign
• Torn, damaged, or recently changed signs
• A QR code that appears to have been added separately

For example, if a parking meter has a QR code covered by a newer sticker, don’t scan it right away. Instead, use the payment method provided by the official parking operator.

3. Preview the URL before opening it

Your phone may show the destination URL after you scan a QR code but before you open the website. If that’s the case, make sure you first read it. Check the URL’s:

• Domain name. Does it belong to the company you expect?
• Spelling. Are there extra or misspelled letters?
• Words in the URL. Does it contain unusual terms such as “verify,” “security,” or “login”?
• Subdomains. Does the actual domain belong to the expected organization?
• URL shorteners. Do you know where the shortened link will take you?

For instance, if the regular URL is only the company’s name and a .com, the suspicious version may look like [company name]-security-login.com

Also, HTTPS websites aren’t always legitimate. While HTTPS protects the connection between your browser and the website, scammers can also use it on fraudulent websites.

4. Don’t enter confidential information on a suspicious website

A professional-looking website can still be fraudulent. You should be extremely careful if the QR code takes you to a page that asks for your personal data. So, never provide details like:

• Passwords
• Bank account information
• Card numbers
• One-time passcodes
• Personal identification information

If a QR code claims that it comes from your bank, payment provider, or another service, don’t use the page it opens to sign in. Instead, open the company’s official app or type its website address into your browser yourself.

5. Verify the QR code before making a payment

Very often, real QR codes are used for payments, which makes them an attractive target for scammers. That’s why you need to check where your money goes before making the payment. To do this, you need to look at the:

• Merchant or recipient name
• Payment amount
• Payment destination
• Details of the transaction

Once you do this, make sure that the details match the business or the person you want to pay. If the name is unfamiliar or the amount is different from what you expected, cancel the transaction and verify the payment through the official website or another trusted method.

6. Treat email or SMS QR codes with caution

You need to be especially careful when you receive a certain message that comes with a QR code in it. Usually, these messages create a sense of urgency and may say:

• “Your package couldn't be delivered.”
• “Your account will be suspended.”
• “Confirm your payment.”
• “Claim your refund.”

In this case, don’t scan the code immediately, but visit the official site or the app of the company. For example, if you have a delivery issue, check the order directly through the official service of the courier. Don’t follow the instructions in the unexpected message.

7. Don’t download apps or files when redirected by a QR code

QR code scams can also take you to a page where you need to download an app or a file. This is pretty risky, especially if the download wasn’t part of what you initially intended to do. More precisely, the page can ask you to install:

• An unfamiliar mobile app
• An APK file
• A browser extension
• A “security” application
• An unexpected file

For downloading apps, always use the official Apple App Store or Google Play Store. As for files, don’t install software just because the QR code asked you to.

8. Regularly update your phone and security software

Regular updates ensure that your device and security tools get an additional layer of protection against malicious websites, apps, and files. Thus, make sure you turn on automatic updates where available and regularly update your:

• Operating system
• Web browser
• Mobile apps
• Security software

These updates can fix security vulnerabilities and improve your device’s ability to detect threats. However, keeping your phone updated shouldn’t replace basic QR code safety checks. They should just be complementary to the checks you run on your own.

9. Use a QR code or scam checker if you’re unsure

In case if you’re not sure whether a QR code is legitimate, you can use a scam-checking tool to evaluate it.

For instance, Scam Protection Pro, included in Bitdefender Premium Security and Bitdefender Ultimate Security, includes Scamio Pro, an AI scam assistant that can check whether a QR code, text, email, screenshot or link is safe or may be a scam.

This is useful when the QR code comes from an unfamiliar source or leads to a website that you don’t recognize.

Visit Bitdefender Antivirus

10. Don’t proceed if something seems suspicious

Last but not least, keep in mind that you don’t need to complete the process just because you’ve scanned the QR code. If the page doesn’t look right, close it and verify the request by using the official company’s phone number, website, or app that you found by yourself.

Here are some cases when I recommend you close the page:

• Creates unnecessary urgency
• Requests unusual personal information
• Demands a payment you weren’t expecting
• Asks for a one-time authentication code
• Wants you to download unfamiliar software
• Doesn’t match the organization you expected

How Bitdefender Premium Security and Ultimate Security offer you an extra layer of QR code protection

To avoid a QR code scam, you should consider adding digital protection from one of Bitdefender’s all-in-one plans, which can provide an additional layer of protection if a QR code leads to a phishing website, malicious download, or fraudulent page.

More precisely, Bitdefender’s all-in-one plans offer digital protection across four plans, Total Security, Premium Security, Ultimate Security, and Ultimate Security Plus, with different levels of scam and identity protection.

Bitdefender Total Security provides essential protection against malware and phishing across major platforms, including web protection that can help block access to dangerous websites.

Bitdefender Premium Security includes everything in Total Security plus Scam Protection Pro, Bitdefender’s AI-powered scam protection, that also offers you Scamio Pro and helps you analyze suspicious content, links, messages, and potential scams. This can be particularly useful when you’re unsure whether the website where the QR code redirected you is legitimate.

Lastly, Bitdefender Ultimate Security and Ultimate Security Plus include all the features of Premium Security and add identity protection, including continuous dark web monitoring, real-time breach notifications, and identity theft insurance with the Plus plan. These features come in handy if the QR scam exposes your personal information.

Visit Bitdefender Antivirus

How to recognize a fake QR code

Now that you know all about QR code scams and how to scan them safely, let’s see how you can detect a fake QR code:

What to check	Warning sign
Source	You don’t recognize who provided it
Physical code	It looks like a sticker placed over another code
URL	The domain doesn’t match the company
Request	It asks for confidential information
Payment	The payment recipient looks unfamiliar
Urgency	It pressures you to act immediately
Download	It asks you to install suspicious software

What to do if you scanned a fake QR code?

Although falling for a QR code scam may sound terrible, it’s not the end of the world. You can prevent further damage by doing the following things:

• Close the page
• Don’t continue with any interactions
• Don’t download anything
• Monitor for unusual activity
• Change the password you entered immediately
• Don’t reuse the compromised password
• Enable two-factor authentication
• Check account activity
• Don’t open unfamiliar or suspicious links
• Remove a file you’ve downloaded, if possible
• Run a security scan
• Check installed apps and permissions

FAQ