Scanned a QR code? Check the web address first

A QR code is convenient because you do not have to type anything. That is also its weakness: you cannot see where it leads until your phone has decoded it, and by then a single tap opens it. This short guide covers what to look at in those few seconds.

A QR code hides its destination

To you, a QR code is a pattern of black and white squares. To your phone, it is text, usually a web address. Anyone with a printer can make one that points anywhere, and nothing in the pattern tells you whether it was put there by the business whose logo is printed next to it. Phishing with QR codes even has its own name: quishing.

It is not limited to stickers in the street. Microsoft counted QR code phishing in email rising from 7.6 million attacks in January 2026 to 18.7 million in March, mostly hidden in PDF (70% in March) or Word DOC/DOCX (24%) attachments (Microsoft, 30 April 2026). In the following quarter the monthly volume fell again, to 8.3 million in June (Microsoft, 23 July 2026). The numbers go up and down; the trick stays the same.

Check the address before you open it

Many camera apps and QR scanners show the web address before they open it. Stop there and read it. If your scanner app has a setting that opens links automatically after scanning, switch it off: Spain's national cybersecurity institute INCIBE recommends exactly that (INCIBE, 4 August 2026). A page that opens straight away leaves you no moment to check.

Then ask one question: is this the address I expected? INCIBE's advice is to check that the web address shown matches the official domain of the establishment or of the service you expected. A parking payment should lead to the site of the council or the parking operator, a menu to the restaurant's own site or a service it clearly uses.

The decoded address is the first stop, not necessarily the last: a normal-looking address can forward you somewhere else, and checking the address cannot show where that chain ends or what the page contains. For anything sensitive, open the official app or a bookmark you trust instead, and do not open a suspicious link just to investigate it.

Read the domain, not just the start

Phishing addresses are made to survive a quick glance. They often start with the name you expect and hide the real destination further along. Some common patterns, using made-up addresses for a town called Harbourton (.example is reserved for examples):

• The right name in the wrong place: in harbourton.example.pay-portal.example/parking the domain is pay-portal.example. The familiar name at the start is decoration.
• Extra words: harbourton-parking-pay.example sounds official, but it is a different domain from harbourton.example, registered by whoever wanted it.
• Lookalike letters: harb0urton.example with a zero instead of an o, or rn standing in for m.
• Shortened links: a short domain followed by a random code tells you nothing about the destination. You only find out where it goes after you open it.

To find the domain, skip https:// and read up to the first /, ? or #, or to the end of the address if none follows. That part contains the host; a port number at the end, such as :8443, and anything before an @ are not part of it. Read the host from right to left. In parking.harbourton.example/pay the domain that matters is harbourton.example, and the parking. in front of it was chosen by the owner of that domain. Everything after the host can be anything at all, including a trusted name: in https://pay-portal.example?next=harbourton.example/pay the host is pay-portal.example, because the ? comes first. If that part contains an @, or you cannot confidently tell which part is the domain, treat the code as suspicious and go to the official site or app yourself.

For more on reading a hostname, including letters from other alphabets, see Different hostname behind a link: red flag or harmless?

Stickers, fines and payment requests

The most direct trick needs no email: a sticker with a fake code stuck over the real one. In March 2025 Alicante City Council warned that stickers with fake QR codes had been found on its ORA parking meters, leading to fraudulent pages that steal bank details, and advised checking that the code is not a sticker covering the original (El Español, 10 March 2025).

In New York, the Manhattan District Attorney and the city's Department of Investigation announced on 30 September 2026 that 64 fake QR codes had been removed from Manhattan parking meters. According to the press release, the code a victim scanned read "Web Pay. Scan to Pay", had been stuck on top of the official PARKNYC sticker, and led to a website showing the official PARKNYC logo that asked for card details. A man has been indicted; the charges are allegations, not proven facts. The District Attorney reminded New Yorkers that "the city does not ask you to scan a QR code when parking" (Manhattan DA and NYC DOI, 30 September 2026). That is New York policy, and elsewhere paying by QR code can be genuine. So check how your own council or parking operator takes payment, through its official website or app, and be wary of any QR code you cannot verify, especially a sticker on top of another code.

Fines are another lure. As reported by Aragón Digital on 14 January 2026, the local police in Zaragoza issued a preventive alert about fake parking fines with a QR code left on windscreens, pointing out that fines are never served by QR code or by a piece of paper on the windscreen. No cases had been detected in Zaragoza at the time (Aragón Digital, 14 January 2026).

Even a menu can be the trap. INCIBE describes a real case in which a restaurant's QR code was the only way to see the menu. According to the diner's account, right after they accepted what appeared to be a cookie pop-up, a premium subscription they had never asked for was activated, and other diners had been affected the same way. INCIBE does not explain how the subscription was set up. If a menu asks for unexpected permissions, an account or payment details, stop and ask the restaurant.

So before you scan a code in a public place, such as on a parking meter, a charging point, a menu or a poster, look at the code itself. Is it a sticker on top of something else? Does it look out of place? Treat any fine or payment request that arrives as a QR code with suspicion, and check it through the official channel instead.

Do not log in or pay through a QR code you cannot verify

My rule is simple: do not sign in or pay through a QR link you cannot verify. You arrived through an address you could not read in advance. If a code asks you to log in or pay, close the page and go to the official site or app yourself: the parking app you already use, your bank's app, the address you know. If in doubt, type the official address yourself rather than trusting the code.

An app that shows what is inside a QR code

Full disclosure: I built this app. QR Quishing Detector by Magentron scans QR and similar codes and shows what is in them, with hidden or disguising characters made visible, before anything is opened. For web addresses it gives a LOW, MEDIUM or HIGH risk rating and explains each point. The risk checks run offline on your phone, and the app never visits the scanned address. I collect nothing: no account, no analytics, no tracking. An optional domain-age lookup, off by default, sends only the domain, not the full address, to the registry for that domain; that operator sees your IP address and the time of the request, as the privacy policy explains. The age it reports does not change the risk score.

A rating is a reason to look twice, not a verdict: a low score does not mean a link is safe, and a high score is not proof of phishing. Part of its heuristic logic, checks and weights is based on the work of Nieves Casquero (qr_forense.py, MIT licence).

A QR code with a web address is a link without link text, so the habit is the same as in email: see where a link goes before you open it. For links in email and on the web, see Reveal URLs: spot phishing links before you click, and for why email apps should show the address by default, see Email link phishing: why your email app should always show the URL.