A QR code is only a compact way to present a destination
The square image does not prove who created it, whether a sticker covers the original, or whether the destination is the organization named nearby. Treat it like an unexpected link. Pause when the code asks for a login, payment, account update, delivery action, refund, or urgent security step.
Verify the request without using the code
Find a separate route
For parking, use the official meter instructions, known local app, or authority website found independently. For an invoice, contact the vendor through the saved record. For a package, open the carrier account directly. For an account alert, use the official app or a bookmarked address.
Inspecting a displayed URL can reveal obvious misspellings, but a plausible address is not sufficient when money or credentials are involved. The claim, identity, and destination should all match through a separate channel.
Check the physical and message context
- Look for a sticker placed over another code, damaged instructions, or mismatched branding.
- Question an unexpected code in a text, email, package, or social message.
- Do not install an app or device profile merely because the scanned page requests it.
- Never send a verification or recovery code to complete someone else's request.
Use the scam verification worksheet when the request has several moving parts. The payment request scam guide covers changed destinations and unusual payment methods.
If you already scanned the code
Scanning alone and entering credentials are different events. Close the page if nothing was entered and check the device for any unexpected download or profile. If you entered a password, change it through the real service, review sessions and recovery settings, and protect other accounts where that password was reused. If you paid, contact the financial provider through a known channel promptly and preserve the transaction details.