How to Scan a QR Code Safely (Without Getting Scammed)

Scanning a QR code safely comes down to one habit: see where it goes before you let it open. Everything else is detail. A QR code is a link in disguise, and the only meaningful question is whether the destination is somewhere you actually meant to go.

Below are the habits worth building, the exact steps for iPhone and Android, and what to do if a scan has already gone wrong.

Safe-scanning habits

• Read the preview banner instead of dismissing it. Both iPhone and Android show the destination before opening. Most people tap straight through it. Reading it takes a second and catches nearly everything.
• Ask who put the code there. A code you went looking for is far safer than one that found you. Codes in unsolicited messages, on loose flyers, and on stickers deserve more suspicion than codes printed into a sign.
• Feel for a sticker. On anything physical, run a fingernail along the edge. A label applied over the original is the most common in-person QR scam.
• Never enter credentials on a page you reached by scanning. If a code leads to a login, close it and reach that site the way you normally would.
• Do not install apps from links in codes. Use the App Store or Google Play directly.
• Keep your phone updated. This closes the narrow set of cases where a malicious page could exploit a browser flaw rather than tricking you.

How to scan safely on iPhone

1. Open the Camera app and point it at the code without tapping anything.
2. A yellow notification banner appears at the top with the destination. Read the domain in that banner.
3. To see it in full, press and hold the banner instead of tapping it. This shows more of the address and gives you a Copy option, so you can inspect the link without opening it.
4. If it looks wrong, swipe the banner away or just move the camera. Nothing opens unless you tap.
5. To turn scanning on or off, go to Settings → Camera → Scan QR Codes.

How to scan safely on Android

1. Open the Camera app, or Google Lens on some devices, and point it at the code.
2. A chip or banner appears with the destination. Read it before tapping.
3. Long-press the result where your device supports it, to copy the link rather than open it.
4. If your camera does not scan codes, look for a Lens or Google Lens icon in the viewfinder, or check Settings → Google → Google Lens.
5. Chrome on Android will warn you about some known-dangerous sites after the page starts loading, which is useful but happens later than you would like.

How to read a link and spot a fake domain

This is the skill that makes the preview banner useful. Domains are read right to left, and the part that matters is the last two segments before the first single slash.

• account.yourbank.com/login goes to yourbank.com. Fine.
• yourbank.com.secure-verify.net/login goes to secure-verify.net. Not fine. The trusted name is a decoy on the left.
• yourbank-secure.com is a different company from yourbank.com. A hyphen changes everything.
• A link shortener hides the destination entirely, so the preview tells you nothing. See our guide to expanding shortened links.

Scammers rely on people reading left to right and stopping at the first familiar word. Reading from the right removes the trick.

When to skip the code entirely

Some situations are not worth the check, because typing an address takes fifteen seconds and removes all doubt.

• Anything involving a payment: parking, tolls, invoices, donations.
• Anything asking you to log in, especially a work account.
• Anything that arrived unexpectedly by text or email.
• Any code on a sticker where the underlying sign looks tampered with.

For donations and charity appeals in particular, go to the organization's own site. Fake charity codes appear reliably after any widely reported disaster.

What to do if a scan has already gone wrong

• You opened a page and closed it. Almost always fine. Scanning by itself does not install anything.
• You entered a password. Change it on the real site, and anywhere you reused it. Turn on two-factor authentication.
• You entered card details. Contact your bank or card issuer, report fraud, freeze or reissue the card.
• You entered a one-time code. Treat the account as compromised. Change the password and sign out all sessions.
• You installed something. Remove it and restart the phone.
• It was a work account. Tell IT immediately. Early beats tidy.

Frequently asked questions

Is it safe to scan QR codes with my phone camera?

Yes, the built-in camera is a fine scanner. Its limitation is that it shows you the link without judging it, so it will preview a phishing page as calmly as a real one.

Can a QR code give my phone a virus?

Not by scanning it. A code carries data, not software. Risk arrives if you install something the page offers or hand over information to it.

Do I need a special QR scanner app?

You do not need one to read codes. A security-focused scanner adds the step your camera skips: checking the destination against threat intelligence blocklists before the page loads.

How do I see a QR code's link without opening it?

On iPhone, press and hold the preview banner instead of tapping, then copy the link. On Android, long-press the result where supported.

Are QR codes less safe than links?

They carry the same risks, with one extra disadvantage: you cannot read them before scanning. That is exactly why they have become popular in scam text messages.

Not sure if a QR code is safe? Check it before you tap.

ScanLikely scans the code and warns you before it opens anything sketchy, links, fake payment pages, rogue WiFi, and more. Free on iPhone and Android.