A QR code is a link you cannot read
Why a square of dots deserves the same caution as an unknown link, and how to check one.
What makes a QR code risky
A QR code holds an address, the same as a link in an email. The difference is that you cannot see the address until your phone has read it. Scammers use this in two ways: they put a sticker with their own code over a real one, for example on a parking meter, and they send codes in messages that claim a delivery or an account needs attention.
Read the address before you open it
When you point the camera at a code, the phone shows the address before opening it. Read it the way you would read a link. Look for a misspelt name, extra words around a familiar brand, or a domain you have never seen.
If the code arrived in a message you were not expecting, do not scan it. Go to the service through its app or its website instead.
Codes in public places
Before you pay through a code on a meter, a table or a poster, run a finger over it. A sticker placed on top of the printed code is a reason to pay another way.
You do not need a separate scanner app. The camera on a current phone reads codes, and an unknown scanner app is one more thing that can go wrong.
This note is our own plain-language summary. For the full guidance, read the original: https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information
If a code on a meter feels like a sticker, pay another way.