QR code safety: simple rules for scanning with confidence

A QR code on its own is harmless: it's just a printed link and can't run anything on your phone. The danger starts after you open it, when a fake site asks for a password, card details or a download. The core habit is simple: read the address in your camera preview before you tap, and don't type anything into a site you don't recognize.

Where the risk comes from

QR codes are convenient because they hide a long link behind a picture. That's also their weak spot: you can't see where a code leads just by looking at it. Scammers exploit this in a handful of ways, sometimes called "quishing" (QR phishing):

• Code swapping. A sticker with a different code is placed over the real one on a package, poster or parking meter.
• Lookalike pages. A site copies a familiar brand's design and asks you to "sign in," "confirm" or "pay."
• Codes in messages. You receive an image of a code with an urgent request to scan it, to "claim a prize" or "unlock your account."
• Grabbing one-time codes. If you post a photo showing an unused claim code, someone else can redeem it before you do.
• Download links. The code leads straight to an app or file from an unknown source.

Rule 1: Read the link before you tap

When your camera recognizes a code, it shows a preview of the link. Before you open it:

1. Check the whole domain. Does it match the brand's official site? An extra letter, a hyphen, a digit in place of a letter, or a different ending are all reasons to pause.
2. Be wary of unknown short links. You can't see the final destination, so pay extra attention to the page that opens.
3. Look for a secure connection, but don't over-trust it. A padlock means the connection is encrypted, not that the site is honest.

When in doubt, skip the code entirely. Type the brand's address yourself and find what you need there.

Rule 2: Look at the code and the packaging

Before scanning a code on a product or in a public place:

• check whether it's a sticker stuck over something else; raised edges, bubbles or an uneven surface give it away;
• on packaging, a genuine code is usually printed as part of the design rather than added as a separate label;
• if a scratch-off layer or seal over the code is damaged and you bought the item sealed, tell the seller.

Rule 3: Don't hand over more than you should

A legitimate site behind a QR code may ask you to sign in or sign up, for example to attach a digital reward or a collectible to your account. Some things, though, should never be entered after scanning a code:

Rule 4: One-time codes are for your eyes only

Many product codes work once: they unlock a reward, a registration or a digital item for whoever redeems them first. A few habits follow:

• don't post photos of packaging with an unused code visible, whether on social media or in group chats;
• don't forward a one-time link to anyone you didn't mean to give the item to;
• redeem the code yourself, and do it right away rather than "later";
• if the code says it's already been used and the packaging was intact, contact the seller.

Rule 5: Slow down when you're rushed

Nearly every QR scam leans on urgency: "offer ends in five minutes," "your account will be locked," "your prize will expire." Real services don't operate that way. If you feel pressured, put the phone down, open the official site yourself and see whether that offer or notice actually exists.

How Crypto Sticker does it

Cryptoscope codes on partner products lead to the official domain, cryptosticker.org. Every code is unique and works once: whoever activates it first receives a collectible sticker in their personal collection. That makes the rules above very practical here:

1. Before you open the link, check that the camera preview shows cryptosticker.org.
2. Don't post the QR code or the one-time link before activation; someone else could use it.
3. To claim the sticker you sign in or sign up on cryptosticker.org, and nowhere else.
4. After activation the link stops working, so scanning it again won't give anything.

Once you have the sticker, you can open its passport page in the registry to see that the record exists, and check your personal collection to see that it's yours. The full walkthrough is in how to verify a digital collectible. Account protection tips are on the security page, and the code itself is explained on the Cryptoscope page.

If you've already opened a suspicious code

Don't panic: opening a page is usually not harmful by itself. Then:

• You didn't enter anything. Close the page and clear the tab.
• You entered a password. Change it right away on the service's official site and turn on extra sign-in protection if it's available.
• You entered card details. Contact your bank immediately, using the number on your card or the bank's official app.
• You downloaded a file or app. Delete it without opening it.
• The code was on a product. Let the seller or the brand know where you found it and how it was attached.

Quick checklist

• A QR code is only a link; the risk lives on the website.
• Read the domain before you tap.
• Never enter passwords for other services or card details after scanning a code.
• Keep unused one-time codes private until you've activated them.
• If you're being rushed, stop and check for yourself.

For more on what sits behind product codes, read how QR codes on products work and what happens after you scan a QR code.