Understand the decision

Look at the context before scanning. Who placed the code, what action does it promise, and does that action make sense where you found it? A QR code on a poster or message can point to an unexpected destination. The FTC warns that scammers can use QR codes to send people to deceptive sites. If the request involves signing in, paying or sharing personal information, take extra care to verify the intended organisation through a route you already know.

A practical workflow

When your device previews a destination, inspect the domain before opening it. After opening, check that the page and requested action match the original context. Do not continue merely because the page looks polished or uses a familiar logo. If anything is inconsistent, stop and ask the organisation through an independently obtained contact route. A genuine business should be able to offer another way to reach the same information without requiring blind trust in an unfamiliar code.

Imagine this

Hypothetical example

A conference attendee scans a stand’s code expecting a public company profile. The destination asks for an account password instead. They stop and ask the stand representative for the official website address, then use that route to find the intended information.

Make it practical.

Use this checklist as you read. Checks are not stored.

References & further reading

Further reading: FTC: Scammers hide harmful links in QR codes ↗

Published by Tap Tap Go. Product availability and eligibility vary by programme and market. About our stories.