How to Check a QR Code Before You Scan It (30 Seconds)

A fake QR code is a sticker or printed code that sends you to a look-alike website, often a fake payment or sign-in page. You can check where any QR code goes in about 30 seconds, before you open it, with your iPhone's own camera.

Checked on 1 November 2026.

Where do fake QR codes show up?

Fake QR codes are most often stuck on top of real ones in public places: parking meters, electric-car chargers, bus stops, posters and restaurant tables. They also arrive in letters and emails that ask you to "scan to pay" or "scan to confirm your delivery". The goal is almost always the same: get you to type a card number or a password into a page the scammer controls.

How do you check a QR code before you open it?

Read the link first. Point your iPhone camera at the code but do not tap yet. The camera shows a small yellow label with the website address. Read the name of the site.

Compare the name. The address should match the company you expect, such as the parking company printed on the meter. Extra words, odd spellings or a link-shortener address are warning signs.

Touch the code. A sticker placed on top of a printed code often has raised edges. If it peels, do not scan it.

If anything looks wrong, skip the code and type the company's address into Safari yourself, or use its official app.

What should you never do after scanning a QR code?

Never enter a card number, a bank password or an Apple Account password on a page you reached from a QR code in a public place unless you have checked the address. Never install an app or a profile that a QR code page asks you to download. Real parking and charging companies also have official apps in the App Store.

What should you do if you already paid through a fake QR code?

Call your bank using the number on the back of your card and ask them to block the card. If you typed a password, change it right away and turn on two-factor authentication. Our guide shows the order: Turn on two-factor authentication.

Does a VPN protect you from a fake QR code?

No. A VPN protects the connection between your phone and the VPN server, so people on the same Wi-Fi cannot see which sites and apps you use. It does not make a fake website safe. The checks above are what protect you here. More on the limits: What a VPN cannot protect you from.

Frequently asked questions

Can scanning a QR code hack my iPhone?

Scanning only reads the link. The risk comes from what you do on the page it opens, such as typing a password or card number.

Are QR codes on restaurant menus safe?

Usually, but check the address the same way. A menu link should go to the restaurant's site or a known ordering service.

How do I report a fake QR code?

Tell the business or the owner of the meter or poster, and tell your bank if you paid.

---

CasperVPN encrypts your internet connection with WireGuard, OpenVPN, IKEv2 and CasperCloak, our own protocol, on iPhone and iPad (Mac app coming). Learn the other quick checks in How to spot a phishing message in 30 seconds or Download CasperVPN →