How to check whether a QR code is safe before you open the link

A QR code hides its destination. You see a square of dots and a promise, such as paying for parking or confirming a delivery, but not the address your phone is about to open. That is what makes QR codes attractive for scams: a sticker over a genuine code on a parking meter, or an email asking you to scan a code to keep your account active.

The address can be read before anything opens. This guide shows where fake codes appear, how to tell who really runs a web address, and how to check a scanned link in QR Studio first.

Where fake QR codes turn up

• Stickers on top of a printed code. Parking meters, charging stations, bike racks and restaurant tables are common targets. Run a finger over the code: a raised edge, or a code that sits slightly off its printed frame, is a warning sign.
• Codes in emails and letters. A message that asks you to scan a code to unlock an account, pay a fine or reschedule a delivery is trying to move you from a computer, where links are easier to inspect, to a phone.
• Pressure to act now. Countdown timers, threats of fines and "last chance" wording are there to make you skip the check.
• Payment and login pages. A code that leads straight to a form asking for card details or a password deserves the most suspicion; when in doubt, use the operator's own app or type its address yourself.

How to read the real address

The part of a link that tells you who runs the site is the domain, and what counts is its end, just before the first single slash. In https://parking.city.example/pay, the domain is city.example. In https://city.example.secure-pay.test/login, it is secure-pay.test, however official the beginning looks.

• Look-alike letters. Some domains use characters from other alphabets that resemble Latin ones, such as a Cyrillic а in place of a Latin a. They are stored as internationalized domain names and are hard to spot by eye.
• A raw IP address such as http://203.0.113.7 instead of a name is unusual for a real business.
• Long chains of subdomains push the real domain out of view on a small screen.
• No https. An unencrypted http link is a reason for caution. The opposite does not hold: https only means the connection is encrypted, not that the site is honest.
• Shortened links hide the final destination completely; you cannot see from the code where they lead.

Check a scanned link in QR Studio

1. Scan the code with QR Studio's camera, or tap Photo to read it from a screenshot, for example of an email.
2. The result opens on its own screen, and links never open automatically. Read the full address shown there, starting with the domain.
3. Tap Inspect link. QR Studio checks the structure of the address on its server and lists anything that deserves a second look: an unencrypted http connection, international characters in the domain, many subdomains, an IP address instead of a domain name, or a local or private network address.
4. If no warnings appear, the app says only that no obvious warnings were found in the URL structure. That is not a safety verdict, so still ask yourself whether the domain belongs to the organisation you expect.
5. Open the link only when the domain matches. QR Studio's Open link accepts web (http and https) addresses only and refuses links with a user name placed in front of the domain, a trick used to make a fake address begin with a familiar name.

If you already opened a suspicious link

• Do not enter anything. Close the page without typing a password, a card number or a verification code.
• If you did enter details, change that password through the service's own app or website, and contact your bank straight away if card details were involved.
• Report a tampered code to whoever runs the meter or venue.
• Delete the scan from your QR Studio library if you do not want to keep it.

Limits worth knowing

No app can tell for certain whether a page is safe. QR Studio's link inspection looks at the address itself; it does not visit the page, so it cannot see what the page shows or where a shortened link finally leads. A familiar, correctly spelled domain remains the strongest signal.

Inspect link runs on the QR Studio service, so it needs an internet connection and a signed-in account; a guest account is enough.