Before You Open That QR Link: A Practical Safety Checklist

Published by Creativall QR · Updated 2026-10-31

A QR code offers a convenient shortcut, but the decision to trust its destination still belongs to you. Before continuing, ask three questions: who supplied this code, where does it lead, and what is the page asking me to do?

This guide is for someone scanning a code on a sign, card or message. It helps you decide when to pause and verify the destination. These checks reduce avoidable risks; they cannot certify that a website is safe.

1. Check the setting before using the camera

Look at the physical label. Is another sticker covering the original code? Does the surrounding instruction appear altered? If something looks wrong, ask the venue or operator for its official route. An apparently untouched label is not proof of authenticity, either. Canada's Get Cyber Safe guidance warns that attackers can replace printed codes or compromise the page behind an existing code. How to use QR codes safely (https://www.getcybersafe.gc.ca/en/blogs/how-use-qr-codes-safely).

An unexpected message needs a different response. A delivery problem or urgent account warning should not push you into scanning immediately. Contact the organization using a website or number you already know, independently of the message. The US Federal Trade Commission identifies these urgency tactics in its QR scam guidance. FTC advice on harmful QR links (https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information).

2. Inspect the link before opening it

Use your phone's built-in QR scanner where available, as recommended by the UK's National Cyber Security Centre. Installing an unfamiliar scanner should not be a prerequisite for checking a link. NCSC guidance on QR risks (https://www.ncsc.gov.uk/blog-post/qr-codes-whats-real-risk).

If the scanner shows a destination preview, read the address before tapping through. Compare it with the organization's known address and look for substituted letters or misspellings. If the preview is abbreviated or you cannot identify the destination, choose an independently verified route instead of guessing. The FTC specifically recommends inspecting unexpected QR destinations for spoofed URLs. FTC QR guidance (https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information).

For example, imagine a fictional gallery notice offering exhibition opening times. You recognize the gallery name on the poster, but cannot recognize the previewed address. You can ask reception or use the gallery's known website. You do not need to solve the unfamiliar address to find the opening times.

3. Do not treat HTTPS as an endorsement

An HTTPS connection protects information in transit between your browser and the website. It does not establish that the website's operator is honest. A fraudulent page can use HTTPS too. Chromium's security team explains why connection security and website trustworthiness must be understood separately. Chromium: An Update on the Lock Icon (https://blog.chromium.org/2023/05/an-update-on-lock-icon.html).

A familiar-looking logo does not settle the question. Consider the destination and the requested action together, even when the page looks polished. If a page's entire argument for trust is a padlock graphic or a security badge drawn inside its own content, you still need independent reasons to trust the organization behind it.

4. Review the request after the page opens

Read what the page wants before entering information. The NCSC advises caution when a QR destination, or a subsequent contact, asks for more information than seems appropriate. That check continues after the camera has done its job. NCSC QR guidance (https://www.ncsc.gov.uk/blog-post/qr-codes-whats-real-risk).

Consider these hypothetical situations:

Example 1
What you expected: An exhibition timetable.
What appears instead: A request for an unrelated account password.
A useful next step: Stop and verify the timetable through the venue.

Example 2
What you expected: A product instruction page.
What appears instead: A file presented as a required new scanner.
A useful next step: Do not install it just to continue; ask the manufacturer for its instructions.

Example 3
What you expected: A public information page.
What appears instead: A form requesting personal details without explaining why.
A useful next step: Look for another route to the information before submitting anything.

These mismatches are reasons to investigate, not a verdict that every unusual page is fraudulent. Canada's guidance recommends checking for unnecessary personal-information requests and obtaining apps through verified app stores instead of QR downloads. Get Cyber Safe advice (https://www.getcybersafe.gc.ca/en/blogs/how-use-qr-codes-safely).

5. Keep a way to finish the task without the QR

Before returning to an uncertain link, state the task plainly: "I need the timetable," "I need the manual," or "I need to contact this person." Then choose a route you can verify, such as the organization's known website or a staff member at the venue.

If you already opened an unexpected page, you can still stop before completing its form or following its instructions. Opening a page is not a reason to finish every step it presents. If you have already shared sensitive information, seek help through the affected service's established support channel.

For organizations sharing codes, make that alternative visible. State what the visitor will find and provide a recognizable route to the same information. Creativall QR's article on matching a QR destination to its printed promise (https://qr.creativall.com/?page=article&slug=qr-landing-page-brand-trust-after-scan&lang=en) explores that design responsibility.

If the camera cannot read the pattern at all, the QR scanning troubleshooting checklist (https://qr.creativall.com/?page=article&slug=qr-code-not-scanning-checklist&lang=en) addresses a separate practical problem. A successful scan confirms readability; deciding whether to continue requires checking the destination and its requests.

Your next useful action may be to open the link, verify it elsewhere, or leave it alone. Keep that choice available at every stage.