The short answer
Pause before opening the destination. Check who supplied the code, inspect the address your phone shows, and use a known website or app if something feels wrong. A familiar logo is not enough to establish who operates a page.
You are standing at a counter, reading a notice, or checking a message. A small square promises to take you straight to the next step. The convenience is real; the question is whether the destination is the one you intended.
Start with where the code came from
Be cautious with an unexpected code in an email or text, especially one demanding immediate action. The US Federal Trade Commission has also reported scams involving replacement stickers over parking-meter codes. For a physical notice, check for signs of a sticker placed over another code. See the FTC’s QR-code guidance.
Read the address before continuing
When your scanner displays a link preview, inspect it before opening the page. Look for misspellings and substituted letters. If you cannot confidently connect the address to the intended organization, stop and find another route. The FTC recommends checking the URL and contacting the organization through details you already know are genuine.
A useful question is: “If this were a link in an unfamiliar message, would I trust it?” The square pattern does not answer that question for you.
Use a familiar route for important requests
If a message says your account needs attention, open the company’s app yourself or use its known website. Check there rather than following the supplied route. The FTC’s phishing advice recommends independently contacting a company even when you already have an account with it.
A request for a password or payment deserves an extra pause. Verify the destination and the reason for the request before entering information.
A fictional example
This scenario is made up. Imagine a text saying a parcel will be returned unless you scan a code immediately. You are expecting a delivery, so the story feels plausible. Instead of scanning, you open the retailer’s app and check the order there. You can investigate the claim without trusting the route the message supplied.
Keep the habit simple
Phone updates and multi-factor authentication add protection; the FTC explains these safeguards. They complement checking the request itself. You do not need to decide whether every suspicious code is definitely fraudulent before choosing a more familiar way to reach the service.
Sources reviewed October 22, 2026. Consumer guidance based on FTC resources. The example is fictional; the artwork contains no functional QR code.