How to Safely Scan a QR Code

Last updated: March 2026 · By the susQR security team · 8 min read

QR codes are everywhere — restaurant menus, parking meters, product packaging, event tickets, and email attachments. But here's the problem: you can't tell the difference between a safe QR code and a malicious one just by looking at it. A QR code that takes you to a restaurant menu looks identical to one that steals your bank login.

In 2025, QR code phishing attacks (called quishing) rose by over 400%. Criminals are placing fake QR code stickers over real ones in public spaces, embedding them in phishing emails, and even printing them on fake parking tickets.

This guide shows you exactly how to safely scan any QR code — step by step — so you never accidentally visit a malicious link again.

Why QR Codes Can Be Dangerous

A QR code is just a visual encoding of a URL (or other data). When you scan one, your phone decodes it and usually opens the link in your browser. The problem is that there's no way to "preview" a QR code with your eyes — unlike a text link where you can at least see the URL before clicking, a QR code hides the destination completely.

This makes QR codes the perfect attack vector for criminals:

• Sticker swaps: Fake QR codes are placed over real ones on parking meters, restaurant tables, and public signage
• Phishing emails: QR codes in emails bypass link-scanning filters because the URL is hidden in an image
• Fake invoices and parking tickets: Scammers leave fake tickets or notices with QR codes that lead to credential-harvesting sites
• Malware downloads: Some QR codes point to files that install malware, keyloggers, or spyware on your device
• Wi-Fi credential theft: QR codes can automatically connect your phone to malicious Wi-Fi networks

Before you even think about scanning, look at the QR code itself. This 5-second visual check catches the most common real-world attack: sticker overlays.

Ask yourself:

• Is the QR code printed directly on the material, or is it a sticker placed on top?
• Can you peel up the corner? If there's another QR code underneath, it's been tampered with.
• Does the QR code match the surrounding branding? (Correct fonts, colors, logos)
• Is it on official signage from a recognizable business?

Most smartphones are configured to automatically open URLs when you point your camera at a QR code. This is exactly what you don't want — it gives you zero time to check the link before your browser loads a potentially dangerous page.

Instead:

1. Open your regular camera app (not a QR scanner)
2. Take a photo of the QR code
3. Upload that photo to a security scanner like susQR

This puts you in control. The QR code is decoded, the URL is analyzed, and you decide whether to visit it — after seeing the security results.

This is the most important step. A QR code security scanner decodes the QR code and analyzes the destination URL against known threat databases — all before you visit the link.

susQR is a free, browser-based scanner that checks every QR code against:

No other free tool gives you this many layers of protection for a single QR code scan.

After uploading your QR code to susQR, you'll see a comprehensive security report that includes:

• The decoded URL — see exactly where the QR code points before visiting
• Risk score — a 0–100 rating based on multiple threat signals (how it's calculated)
• VirusTotal results — how many of 90+ security vendors flag the URL
• Redirect chain — every hop the URL takes before reaching the final destination
• Domain age and registration — newly registered domains are a common phishing indicator
• URLhaus status — whether the URL appears in active malware databases

Even with a security scan, you should personally inspect the URL. Human judgment catches things automated scanners sometimes miss — especially brand-new phishing domains that haven't been reported yet.

Watch for these red flags:

Red Flag	Example
Misspelled domains	paypa1-verify.com instead of paypal.com
Suspicious TLDs	.tk, .ml, .xyz, .top, .click
Raw IP addresses	http://192.168.1.1/login
URL shorteners	bit.ly/abc123 — hides the real destination
Excessive subdomains	secure.login.paypal.com.evil-site.tk
Random character strings	abc123xyz.com/j8k2m

Two things to check:

1. HTTPS encryption: The URL should start with https://. While HTTPS alone doesn't guarantee a site is safe, any site asking for personal information over plain HTTP is a definite red flag.

2. Redirect chains: Phishing attacks commonly use redirect chains — the QR code points to URL A, which redirects to URL B, then to URL C, before finally landing on a fake login page. Legitimate businesses rarely chain more than one redirect.

susQR automatically traces the full redirect chain and shows you every hop, so you can see the actual final destination — not just the first URL in the chain.

After completing steps 1–6, you should have a clear picture of whether the QR code is safe:

How to Use susQR to Scan Safely (Walkthrough)

Here's exactly how to use susQR to check a QR code in under 30 seconds:

susQR works entirely in your browser — no app installation required. It works on iPhone, Android, and desktop.

susQR vs. Your Phone's Built-in QR Scanner

Every smartphone has a built-in QR scanner, but it wasn't designed for security. Here's how it compares:

Feature	Phone Camera	susQR
Decodes QR code	✓	✓
Shows URL before opening	Partial	✓ Full URL
Scans URL against 90+ security vendors	✗	✓
Checks malware databases (URLhaus)	✗	✓
Snort IDS analysis	✗	✓
Traces redirect chains	✗	✓
Risk score	✗	✓
Works without installing an app	✓ Built-in	✓ Browser-based
Free	✓	✓
Prevents auto-opening malicious links	✗	✓

Your phone's camera is fine for QR codes you trust — like a code on your own product or a known app. For anything you encounter in the wild, use susQR first.

What to Do If You Already Scanned a Suspicious QR Code

If you scanned a QR code and now suspect it was malicious, take these steps immediately:

1. Close the browser tab — don't interact with the page any further
2. Change your passwords — especially if you entered any credentials on the site
3. Enable two-factor authentication — on any accounts that could be affected
4. Monitor your accounts — check bank statements, credit card activity, and email for unauthorized access
5. Run a device security scan — use your phone's built-in security features or a reputable antivirus app
6. Report the QR code — notify the business whose QR code was replaced, and report the URL to IC3 (FBI's Internet Crime Complaint Center)

Frequently Asked Questions

susQR is a free, open-source QR code security scanner. No account required. No data stored. Learn more about susQR.