How to Check a QR Code Before Paying or Signing In
An unfamiliar QR code can be convenient, but the page it opens still needs verification.
This guide focuses on decisions you can make with information you can check yourself. Work through the evidence in order, document anything that may change, and prefer the original provider or authority for current conditions. The goal is to make the next practical step easier, not to promise an outcome that depends on other people or services.
Inspect the physical code
On a parking meter, restaurant table or poster, look for a sticker placed over an original code. Tampering is not always obvious. If a business has an official app or printed payment instructions, compare the destination shown on your phone with that trusted route before proceeding.
Preview the actual destination
Use the phone camera preview to read the destination domain before tapping. Read the full hostname, not just a familiar brand appearing elsewhere in the address. A long URL or shortened link is not automatically malicious, but it hides useful context until you investigate.
Separate information from payment
Reading a public menu is different from entering card details or a password. For a payment, open the merchant or operator website manually from a verified source. Do not type banking details into an unfamiliar checkout because a sign tells you it is urgent.
If you already opened the link
Opening a webpage alone does not prove your phone is compromised. Close suspicious prompts, avoid downloading files, and update your device. If you entered an account password, change it through the genuine site and review sessions; if you entered payment details, contact your bank.
Save a repeatable rule
Use three questions: Do I trust the code placement? Does the hostname match the official business? Is the information requested appropriate for this action? If any answer is uncertain, choose an independent route before continuing.
Worked example
Example: a parking machine displays a payment QR code over a second sticker. Instead of scanning, open the parking operator website from its signboard or customer service number and confirm the vehicle zone and payment total. If the official method cannot be established, use a different verified payment option.
Common mistake to avoid
Do not treat an HTTPS padlock as proof that the business is genuine. Encrypted connections can also exist on fraudulent websites.
Printable five-step checklist
Use these prompts as a short worksheet. Save the answers next to your own notes so you can repeat the process rather than relying on memory or a single screenshot.
Questions people ask
What should you verify first?
Begin with “inspect the physical code.” Check the original evidence, then make the smallest reversible decision available. If the information is incomplete, record what remains unknown before making a commitment.
How can you avoid a common mistake?
Do not treat an HTTPS padlock as proof that the business is genuine. Encrypted connections can also exist on fraudulent websites. Retest the conclusion against the source links below, especially when pricing, eligibility, safety guidance or software functions may have changed.