← Back to guides
QRPro CloudCreate account ↗
QRPro Cloud / Security

A QR code is a link in disguise: look before you open

The code is not dangerous by itself; the destination is. The defense is simple: see the URL, check the domain and do not type data without a reason.

Direct answer

Preview the link before opening it, distrust shorteners and misspelled domains, and never enter passwords or card details after scanning a QR code. The HTTPS padlock does not guarantee legitimacy.

The warning signs

  • Sticker over another code: on parking meters, posters or menus. If it can be peeled off, be suspicious.
  • Unknown shortener: it hides the real destination. A serious business may use its own, but not a random one.
  • Misspelled domain: paypa1.com, banco-seguro-verificacion.com, long subdomains that imitate a brand.
  • Hurry and threats: “your account will be blocked”, “pay within 10 minutes”, “verify so you do not lose the parcel”.
  • Impossible request: a QR code in the street that asks for your bank password or card details.

How to check it in practice

  1. Use a reader that shows the URL and does not open automatically.
  2. Read the domain from right to left: what comes before the first slash is what matters.
  3. Compare it with the official domain you already know, not with the one on the poster.
  4. If the destination asks for a login, close it and go in by typing the address by hand.
  5. If it is a payment, open the bank app and collect from inside; do not scan a QR code someone sends you to “receive”.

Why HTTPS is not enough

A certificate only proves that the connection is encrypted, not who is behind it. Anyone can get one for a new domain. The right question is not “does it have a padlock?” but “is this domain the one of the company it claims to be?”.

Rule: if the QR code asks you to install an app outside the official stores, give access to your screen or pay through a method you do not recognize, stop.

If you already scanned it

Close the page without entering anything. If you typed credentials, change them from the official app or site and turn on two-step verification. If you gave card details, call the bank and block the payment method. If you installed an unknown profile or app, uninstall it and review the permissions. Keep a screenshot of the code and the poster: it helps to report it.

Report the fake QR code to the establishment and, if it is on public property, to the local authority or city council. Overlaid codes usually affect many users.

Frequently asked questions

Is HTTPS safe?
It encrypts, but it does not prove identity.

How do I see the destination?
With a reader that shows the URL before opening.

What if I already scanned it?
Close it, change your passwords and tell the bank if you gave payment details.

QR codes in the street?
Yes, check that there is no overlaid sticker.