Can QR Codes Be Phishing?
A QR code hides a destination; check before you open it.
Free video lesson · 1:12
Can QR Codes Be Phishing?
Phishing Awareness for Beginners
Music: “Thinking Music” by Kevin MacLeod. Creative Commons Attribution 4.0.
A QR code hides a destination; check before you open it.
Read the video transcript
A QR code is a square pattern that your camera can read. It often holds a web address. Reading the pattern is not the same as proving that the destination is trustworthy.
Imagine a poster promising a school-event discount. Its QR code could open the real booking page. But someone could cover that code with a sticker leading to a different site.
Many phones show the web address before opening it. Read that preview. A strange spelling or an unexpected address is a warning. You do not have to open the page to investigate.
If you are unsure, ask the event organizer or use the event’s known website. Do not assume that a code printed on a poster has been checked by someone else.
The pattern itself cannot tell you who placed it there. Treat an unexpected QR code like an unexpected link. Choose a trusted way to reach the page before entering payment details or a password.
For another clear example, watch How Do You Check a Link Without Clicking? Then try What Is a Fake Login Page?
The short answer
A QR code is a square pattern that your camera can read. It often holds a web address. Reading the pattern is not the same as proving that the destination is trustworthy.
A simple example
Imagine a poster promising a school-event discount. Its QR code could open the real booking page. But someone could cover that code with a sticker leading to a different site.
Many phones show the web address before opening it. Read that preview. A strange spelling or an unexpected address is a warning. You do not have to open the page to investigate.
If you are unsure, ask the event organizer or use the event’s known website. Do not assume that a code printed on a poster has been checked by someone else.
The pattern itself cannot tell you who placed it there. Treat an unexpected QR code like an unexpected link. Choose a trusted way to reach the page before entering payment details or a password.
Put it into practice
- Look for an address preview before opening a QR destination.
- Watch for replaced stickers or an unexpected destination.
- Use the known website or ask the organizer when you are unsure.
Check your understanding
A QR code is printed on a real poster. Does that prove its destination is safe?
Answer
No. Someone could replace the code. The pattern does not authenticate the person who put it there.
Explore next
Follow the free video course one question at a time. Teams can practise these habits through security training. For the cryptography protecting your systems, explore a cryptography audit.