How to Know If a QR Code Is Safe Before You Scan It
You park your car, walk over to the meter, and see a QR code beside the payment instructions.
Scanning it feels perfectly normal. The parking meter is real, the sign looks official, and you are standing exactly where you expect to pay.
That is what makes a fake QR code difficult to notice.
The problem may not be the parking meter at all. Someone can place a new QR sticker over the legitimate one and send drivers to a completely different website.
In September 2026, the U.S. Federal Trade Commission warned about reports of exactly this kind of scam involving parking meters.
So the useful question is not whether QR codes in general are safe.
It is whether the particular code in front of you belongs there, where it is trying to send you, and what happens once you arrive.
The QR Code Hides the Part You Really Need to See
If someone sends you a web address such as:
cityparking.example.com
you can read it before deciding whether to visit.
A QR code hides that destination inside a black-and-white pattern.
That convenience is the reason QR codes work so well. You do not have to type a long address.
It is also the weakness scammers can take advantage of.
A legitimate QR code might open a restaurant menu, medical form, event ticket, parking payment page, store promotion, or business website.
A fraudulent one can look almost identical while pointing somewhere else.
Looking carefully at the square itself will not tell you much.
The useful information appears before and after you scan it.
A Real Location Does Not Guarantee a Real QR Code
Return to that parking meter for a moment.
Everything around the QR code may be legitimate. The machine belongs to the city or parking company. The parking space is real. The payment instructions may even be genuine.
Only a small sticker may have changed.
The Federal Trade Commission says people have reported scammers covering legitimate parking-meter QR codes with their own codes. Scanning the replacement can lead to a fake website designed to collect money or personal information.
Before using a QR code attached to a public machine or sign, take a closer look at how it was placed.
A code printed as part of the original sign is different from a separate sticker that looks newer than everything around it.
That does not prove a sticker is fraudulent. Businesses legitimately add and replace QR codes.
But if something looks as though it was placed over another label, that is a good reason to use another payment route.
Look for the official parking app, a website printed elsewhere on the machine, a payment number, or another method provided by the operator.
Your Phone May Show the Destination Before You Open It
Scanning and opening are not always the same action.
On many phones, pointing the camera at a QR code produces a notification or link preview first. The FTC recommends looking at that destination before opening it and checking for spelling errors or switched letters.
That small preview deserves more attention than most of us give it.
Suppose the company you expect is:
harbourparking.com
but the preview shows:
harbour-parking-pay.com
Those are not the same domain.
Neither is:
harbourpark1ng.com
where the letter “i” has been replaced with the number “1.”
Scam websites often depend on people recognizing the familiar-looking part of an address and ignoring the rest.
If the destination looks unfamiliar, there is no need to solve the mystery by opening it.
You can leave the QR code alone and reach the company another way.
What Matters Before You Trust the Code
A QR code becomes easier to judge when you separate three different questions.
Where did you find it?
A QR code displayed on an official restaurant menu in your hand is not the same situation as a sticker added to a parking meter.
A code inside your bank's official app is different from one arriving in an unexpected email claiming to be from the bank.
Context does not prove authenticity, but it tells you how much verification makes sense.
Where is it trying to take you?
Read the destination your phone shows before opening it when that information is available.
Do you recognize the domain?
Does the spelling match the organization you expected?
If you already have the company's official app, opening that app yourself may be easier than deciding whether an unfamiliar QR link is genuine.
Does the request make sense?
Imagine that you expected to pay $4 for parking.
After scanning, the page asks for your online banking password, government identification number, or permission to install an app.
The request no longer matches the job you were trying to accomplish.
That mismatch is often more useful than trying to judge how professional the website looks.
A polished page can still be fraudulent.
| Situation | What fits | What should make you hesitate |
|---|---|---|
| Restaurant menu | Opens the restaurant menu or website | Requests banking login or an app installation |
| Parking meter | Opens the operator's payment page | Domain does not match the parking company |
| Medical office | Opens the expected clinic form | Requests unrelated financial credentials |
| Delivery message | Matches a shipment you can verify independently | Unexpected message demanding immediate payment |
| Bank or financial service | You reach it through the official app or known site | QR code asks you to log in from an unexpected message |
The point is not to decide whether every QR code is good or bad.
It is to see whether the location, destination, and request agree with one another.
The Padlock Is Not Enough
Many people were once taught to look for a padlock symbol or https:// before entering information online.
Encrypted connections are important, but they answer only one question: whether the connection between your device and the website is encrypted.
They do not prove that the website belongs to the company you intended to visit.
A fraudulent website can also use HTTPS.
That is why the padlock should never be the only thing you check. The domain name and the reason for the visit matter too.
If you intended to pay a parking company, make sure you are dealing with that parking company—not merely a secure connection to a site you do not recognize.
Be More Cautious When the QR Code Comes Looking for You
There is an important difference between choosing to scan a QR code at a restaurant and receiving one unexpectedly.
A message might say that a parcel cannot be delivered until you scan a code.
An email might claim that your account needs immediate verification.
A card inside a package you never ordered might invite you to scan a code to discover who sent it.
Those situations deserve more caution because someone else initiated the contact and is trying to move you somewhere.
If unexpected delivery notices, banking alerts, or payment messages are also a concern, see How to Tell If a Text Message Is a Scam. Many of the same warning signs—unexpected contact, urgency, and pressure to follow a link—also appear in QR-code scams.
The FBI warned in July 2025 about unsolicited packages containing QR codes. In that scheme, people may receive merchandise they never ordered, sometimes with no sender information. The QR code can lead to requests for personal or financial information or to malicious software.
Curiosity is part of what makes the technique work.
If you receive a package you did not order, you do not need to scan a QR code to find out why it arrived.
Likewise, if a delivery company supposedly needs information from you, open the company's official app or type its known website into your browser instead of entering through the QR code.
A Familiar Company Name Can Still Lead to the Wrong Place
Suppose a QR code opens a page displaying the logo of your bank.
The page uses the same colors as the bank's website.
It asks you to sign in.
None of those things confirms that the bank created the page.
Logos, photographs, text, and website designs can be copied.
The web address gives you something more useful to check than the logo or page design.
If you would normally reach your bank through its app, use the app.
If you would normally type the bank's website yourself, do that.
There is rarely a good reason to choose an uncertain QR link when you already know a trusted route to the same service.
What If You Already Opened the QR Link?
Opening a suspicious link does not mean that every possible bad outcome has already happened.
What you did next matters.
If you only opened the page and did not enter information, download anything, or approve permissions, close it and avoid further interaction.
Keep your phone's operating system and apps updated. The FTC specifically recommends current software as part of protecting a phone from malicious links.
If you entered a username and password, go to the real service through its official app or website and change the password.
A password reused on other accounts should be changed there as well. If you are not sure how to replace it with something both stronger and easier to manage, read How to Create a Strong Password You Can Actually Remember.
If you entered credit or debit card information, review the account for transactions you do not recognize and contact the card issuer through a trusted number, such as the one printed on the card or listed in its official app.
If the QR page persuaded you to install an unfamiliar app or grant unusual permissions, remove the app and review what access you approved.
The important distinction is what information or access left your control after the scan.
Sometimes the Best QR-Code Safety Feature Is Not Using the QR Code
QR codes are convenient, but convenience does not create an obligation.
If a restaurant code seems questionable, ask for a printed menu or the restaurant's website.
If a parking code looks altered, use the official app, type the operator's web address yourself, or follow another payment method printed on the machine.
If a medical office wants you to complete a form and you are uncertain about the code, ask the office to confirm where it should lead.
Choosing a different route does not mean avoiding technology.
It simply gives you a destination you can verify.
The Next Parking Meter
The next time you stand beside a parking meter with your phone in your hand, you do not have to decide whether QR codes are trustworthy technology.
That question is too broad to be useful.
Look at the code in front of you.
Does it belong where you found it?
Where will your phone take you?
And once you arrive, does the website ask for something that makes sense for what you were trying to do?
If those answers fit together, the QR code is doing what it is supposed to do: saving you the trouble of typing an address.
If they do not, skip the shortcut.
There is almost always another way to get where you were trying to go.
