You cannot determine whether a QR code is safe by its module pattern or styling. Evaluate the physical context, the decoded preview, and the action being requested.

Inspect before scanning

Look for a sticker placed over another sticker, lifted edges, mismatched print quality, altered instructions, or a code positioned where the responsible organization would be unlikely to put one. Tampering is not always obvious, and a clean label is not proof of safety.

Compare visible branding and the printed domain with official information obtained independently.

Read the preview

Pause before opening. Check the actual host from right to left: in login.example.com, the registered domain is typically example.com, while example.com.attacker.test belongs under attacker.test. Watch for spelling substitutions, unfamiliar shorteners, unexpected numeric addresses, and non-HTTPS links.

This rule is simplified; internationalized domains and complex public suffixes deserve extra care. For a high-stakes action, use a trusted bookmark or official app.

Question the requested action

Unexpected requests for passwords, payment card details, one-time codes, cryptocurrency, app installation, configuration profiles, or broad device permissions are warning signs. Urgency and threats - “pay in five minutes” or “account closes now” - are common social-engineering pressure.

Original decision example

A flyer in a lobby promises a building refund. The visible management company URL differs from the camera preview, and the page asks for a banking password. Any one signal is enough to stop. The resident contacts management through the number on an existing statement and reports the flyer.

If you already interacted

Close the page, do not continue entering information, and contact the relevant organization through an independently verified channel. If credentials were entered, follow that service’s official compromise procedure, change passwords from a trusted device, and enable appropriate multi-factor authentication. For financial exposure, contact the financial institution promptly.

Sources and further reading

Create the code you need

Use HighEndDIY’s private browser tool, then test the result in the setting where people will scan it.

Create a QR Code

Found something that should be corrected? Email [email protected].