Is this QR code legit? See where it goes before you open it

Read the code with the QR code reader and look at the address before you visit it. The reader shows the full text of the code and names the website a link goes to, and it never opens the link for you, so you decide with the whole address in front of you.

Why this matters

A QR code gives no visual hint of where it leads. A known trick, sometimes called quishing, is to stick a printed code over the real one on a parking meter, a poster, a bill or a restaurant table. The fake sends people to a page that looks like the real payment or login page and collects card numbers or passwords. A phone camera that opens links in one tap makes this easy to fall for, especially in a hurry.

Steps

1. Take a photo of the code, or a screenshot if it arrived in a message or email.
2. Open the QR code reader and choose the picture. On a laptop, Use camera reads a printed code from the webcam instead.
3. Read the panel. A link shows as Web link, followed by the full address and a line that says "Goes to" and the host name.
4. Compare that host name with what you expect, using the checks below.
5. If it matches, type the address yourself or copy it into your browser. If anything is off, do not visit it.

What to check in the address

The reader calls out the host: the part between https:// and the first /. Read it from the right. The last two parts (three for endings such as .co.uk) name the site that will actually load; anything to their left can be made up by whoever owns that site.

A link shortener is not proof of a scam, but it hides the destination, so treat it with more care. Search for the organisation's own website separately and pay there instead.

Signs on the object itself

Before you even scan, look at the code:

• A sticker on top of another printed code, or one with lifted or uneven edges.
• A code on a meter or sign where the operator normally tells you to use an app or a card reader.
• A code that arrived in an unexpected email or letter saying your account is locked, a parcel is held or a fine is due.
• Pressure to act fast: "pay within 10 minutes".

When in doubt, pay through the operator's own app, its website typed by hand, or the machine itself.

Other kinds of code

Not every code is a link. The reader labels each type:

• WiFi network: shows the network name and password. Joining an unknown network in a public place is a risk of its own.
• Contact card: shows the name, number and email before anything is saved.
• Email address or Phone number: shows who you would be writing to or calling.
• Text: shown exactly as stored.

If you already opened a bad link

• Do not type anything into the page. Close it.
• If you entered card details, call your bank using the number on the back of your card.
• If you entered a password, change it on the real site and anywhere you reuse it.
• Report the fake code to the business or council that owns the meter or sign.

Questions

Does the reader check whether a site is dangerous?

No. It shows the address and the website name so you can judge it. It does not look the site up anywhere or rate it.

Why doesn't the reader just open the link?

Because the point is to see the address first. You can copy it and open it yourself once you are happy with it.

Is my photo of the code sent anywhere?

No. The picture is read on your device in the browser and is not uploaded.

Can I make my own code that people can trust?

People trust codes they can check. When you make a QR code, use a short link on your own, recognisable website, and print the address in words beside it.