Checking a QR code takes about ten seconds and needs nothing you do not already have. Point your camera, read the address it shows, decide whether the domain is the one you expect, and only then tap. For anything you are unsure about, a free checker can read the code and explain it without opening it. This guide walks through each step on iPhone and Android, and what to do if you already tapped.
Can you check a QR code without opening it?
Yes. A QR code does not do anything on its own. It is a pattern that holds a short piece of text, usually a web address, sometimes a Wi-Fi network, a contact card or a payment request. Your phone reads that text and shows you what it found. Nothing opens until you tap.
That pause is your whole defense. Most phones show the address for a second or two in a banner, and that is enough time to read the domain. The scams in our list of common QR code scams all rely on people tapping through that banner without reading it.
Step 1: see the address before you tap
iPhone. Open the Camera app and hold it over the code. A yellow banner appears at the top with the address or the domain. Do not tap it yet; read it. If you want a bigger preview, open Control Center and use the Code Scanner, which shows the link on screen before opening it. If your camera is opening pages without a banner, check Settings, Camera, and make sure scanning QR codes is on; the banner comes with it.
Android. Most camera apps show the address in a chip at the bottom of the screen, or hand the code to Google Lens, which shows the full link above an "open" button. Samsung phones show the link in a pop-up. Again, read before you tap.
Any phone. If you prefer a scanner app, choose one that shows the full address and asks before opening. Avoid scanners that open links automatically; that setting removes the only pause you get.
Step 2: read the domain like a scammer wrote it
The domain is the part of the address just before the first single slash, and it is the only part that tells you who runs the page. Everything before it and after it can be made to say anything.
Take a parking operator whose real site is citypark.example. A scammer can register citypark-pay.example-billing.com and the preview will show that, with "citypark" sitting right at the front where your eye lands. Read to the end of the domain, not the start.
What to look for:
- Extra words.
yourbank-secure.comis notyourbank.com. - Swapped or doubled letters.
rnenuformenu,paypa1forpaypal,arnazonforamazon. - The wrong ending.
.comwhere you expect.co.uk, or an ending you have never seen. - A bare number address.
http://185.x.x.x/...is almost never a real business. - A short link you cannot read. Not a scam by itself, but you cannot judge it until you unwrap it (step 3).
- No padlock, or a warning from the browser. If the browser says the page is not secure, close it.
Our glossary entry on checking QR code safety has a picture of a real domain next to a lookalike if you want one for a training deck.
Step 3: unwrap short links and anything you cannot read
Many legitimate codes use short links: menus, event tickets, tracked campaigns. The link is a redirect, and the real destination is what matters. Two free tools show you where a short link or a code goes without opening it:
- The QR code safety checker reads a photo or screenshot of a code on your device, explains what it does in plain words, a website, a Wi-Fi network, a call, a payment, and flags common tricks: lookalike domains, hidden characters, bare number addresses, app installers and premium phone numbers. The image and the link never leave your phone, and the link is never opened.
- The link safety checker does the same for a pasted address, including short links.
- The QR code reader shows the raw text inside a code from a photo or screenshot, useful when you want to see exactly what a Wi-Fi, contact or payment code would hand to your phone.
For AriaQR's own short links, there is a stronger check behind the scenes: every destination is checked against Google Safe Browsing when the link is made and re-checked over time, reported links show a warning page that names the destination, and blocked links never redirect. The details are in are short links safe.
| What the preview shows | What to do |
|---|---|
| The brand's own domain, spelled right | Open it |
| A short link from a company you trust | Fine for a menu or a ticket; still never type a password there |
| A short link from an unknown source | Unwrap it with a checker first |
| A lookalike domain or a number address | Do not open; report it |
| A Wi-Fi, contact or payment code you did not expect | Decline; a stranger's code should never change your phone's settings or move money |
Step 4: judge the page, not just the link
A clean address can still lead to a page that asks for too much. The rule is simple: a QR code page should give you something, a menu, a ticket, a product page, a form, and should not take your password or card number to do it.
Close the page if it:
- asks you to sign in to a service you already use on that phone,
- asks for card details before showing you what you are paying for,
- wants you to install an app or a "profile" from outside the app store,
- shows a countdown, a threat, or an urgent fee.
If you are meant to pay, and you trust the venue, pay through the venue's own app or a page you reached yourself.
What if you already scanned it?
Scanning alone does nothing. Work out which of these happened:
- A page opened and you closed it. Nothing to do.
- You typed a password. Change it on the real site, turn on two-step sign-in, and change it anywhere else you used it.
- You entered card details. Call your bank on the number printed on the card.
- You installed something. Remove it, then run your phone's built-in security check.
- You joined a Wi-Fi network. Forget the network in settings.
Then report the code: to the venue if it was a sticker, to your national fraud service, and, if it was an AriaQR link, at ariaqr.com/report.
How AriaQR keeps its own links safe
The checks above are the ones you can do from the outside. On our side, every AriaQR code runs on a short link that we check so that you rarely have to. The controls are listed in full on our security page; in short:
- Safe Browsing on every link. Destinations are checked against Google Safe Browsing when a link is made or changed, and short links and free codes are re-checked every day. Flagged links stop redirecting.
- No hidden hops. Links to other shorteners and to bare number addresses are refused, so an aqr.li link points straight at a real site.
- Anyone can report. The report page needs no account. Reported links show a warning that names the destination; blocked links never redirect.
- Payment codes are locked to the signed-in owner, so nobody can quietly redirect money.
- Opening a link costs you nothing in privacy. No cookies, no stored network address, no permission prompts. Our privacy policy has the detail, and our post on what happens when you scan a QR code explains what a code's owner can and cannot see.
Where to start
Make the banner habit automatic: camera, read the domain to the end, then tap. Unwrap anything you cannot read with the safety checker, and treat any request for a password or card as a stop sign. If you print codes for other people to scan, make them easy to trust: point them at your own domain, make them look like your brand, and keep control of where they go. You can make a code that way in a minute, and see pricing when you are ready.