QR Code Scams: How to Check Before You Scan

QR code scams use a code to steer you to a deceptive website, payment request or other action, so check where it leads before you continue. A QR code is not proof that a link or payment request is genuine: treat it like any other link you might receive by email or text.

How QR code scams work

A QR code stores information that a phone can read, often a web address. When you scan one, your phone may show a preview of the destination. If you choose to open it, the website can look similar to a legitimate business, service or payment page while directing you to enter information or send money.

The code itself does not tell you whether the destination is safe. A fraudster can create a code that opens a fake sign-in page, a payment page, a form asking for personal information, or a download. The same warning applies whether the code is printed on paper or displayed on a screen.

In some situations, a person may cover a legitimate QR code with a different sticker or replace the original material. A code can also be shared in a message or posted online with a misleading explanation. Even if the code looks ordinary, check the destination and ask whether the request makes sense before acting.

QR code scam variations Canadians may encounter

QR codes can appear in everyday places, including restaurant menus, event materials, payment notices and promotional flyers. A code in a familiar setting can still lead somewhere unexpected. Check that the code belongs with the item and that the instructions are consistent with what the organization says through its official channels.

Payment is a particular risk. A code on a notice, bill or sign might open a page asking for card or banking details. Before paying, look for a way to verify the amount and recipient independently, such as using the organization’s official app or typing its known website address yourself.

Other QR code scams may try to collect passwords or personal details through a sign-in page, or persuade you to install software. A page might use familiar colours or symbols, but those design choices do not confirm who operates it. If a code asks you to log in, disclose sensitive information or install something you did not expect, pause and verify the request.

A QR code can also arrive in a text or email that creates pressure to act. For example, the message may claim you need to confirm an account or resolve a problem. Do not rely on the message’s explanation; contact the organization using contact details you find independently.

Red flags to notice before scanning

Look at both the code and the request around it. A code may be technically readable but still lead to a harmful destination. These warning signs are reasons to stop and check:

• A sticker appears to cover another code, or the code looks damaged, altered or out of place.
• The sign or message gives little explanation about what the code will open or why you need to scan it.
• You are told to act urgently, pay immediately, or provide sensitive information to avoid a problem.
• The web address shown in the preview is unfamiliar, misspelled, or unrelated to the organization you expected.
• The page asks for a password, banking information or payment details that do not seem necessary for the task.
• You are asked to install an app or file from an unexpected page.
• The payment recipient, amount or purpose is unclear, or does not match what you were expecting.
• The person or message discourages you from checking through another channel.

How to check a QR code safely

Start by asking whether scanning is necessary. If the code is meant to open a menu, payment page or account, you may be able to reach the service by using its official app or entering its web address yourself. This avoids trusting a code whose source you cannot confirm.

If you do scan, pause at the preview instead of opening the destination automatically. Read the full web address carefully. A familiar name in the address is not enough: look for misspellings, extra words or a domain that does not match the organization. Do not follow a shortened or unclear address if you cannot verify where it goes.

Inspect printed codes before using them. Check whether a sticker sits on top of another code, whether the surrounding instructions look consistent, and whether the code is attached to the right item. If anything seems changed or unclear, ask staff or the organization through a contact method you locate independently.

For payments, confirm the recipient and amount using a trusted source before approving anything. A payment page reached from a QR code should not get special trust just because it is convenient. If you cannot verify the request, use another payment method or leave the transaction until you can check.

Keep your phone’s operating system and apps updated, and use its built-in security features. The Canadian Centre for Cyber Security provides general advice on protecting yourself online. Security tools can help, but they cannot guarantee that every link is safe; careful checking remains important.

What to do if you scanned a QR code

Scanning alone does not necessarily mean your information has been exposed. What matters is what happened next. Close the page if it seems suspicious, and do not enter details, approve a payment, download a file or follow further instructions.

1. If you only scanned it: Close the page and avoid returning to it. If it prompted an unexpected download, do not open the file or install the app. Check your device using its built-in security features.
2. If you entered a password: Change it using the service’s official app or website, not the link from the code. If you used that password elsewhere, change it there too. Turn on additional sign-in protection if it is available.
3. If you shared banking or card details, or sent money: Contact your bank or card issuer using the number on your card or its official app. Explain what happened and ask what steps to take to protect the account or dispute a transaction.
4. If you installed an app or file: Stop using it, remove it if you can do so safely, and use your device’s security settings or trusted technical support to check the device. Do not follow instructions from the suspicious page to fix the problem.
5. Save useful details: Keep the message, page address, payment record or a photo of the code if it is safe to do so. Do not revisit a suspicious page just to collect information.
6. Tell the organization involved: If the code was on a sign, notice or business material, contact the organization through a verified channel so it can check the material and warn others if needed.

How to report QR code scams in Canada

Report suspected fraud to the Canadian Anti-Fraud Centre online at antifraudcentre-centreantifraude.ca or by phone at 1-888-495-8501. You can report an attempted scam even if you did not lose money.

Contact your local police if you have been victimized or believe a crime has occurred. If money or banking details were involved, contact your bank or card issuer promptly using a trusted number or official app. Keep records of your report and any steps the bank asks you to take.

Frequently asked questions about QR code scams

Can scanning a QR code infect my phone?

Scanning a code usually opens or previews the information it contains; the greater risk is what you do after that. A page may try to trick you into entering information, approving a payment or downloading something. Close an unexpected page and do not install anything it offers.

How can I tell if a QR code is fake?

You may not be able to tell from the pattern alone. Check whether it has been covered or altered, read the destination shown by your phone, and verify that the request makes sense. If the page or request seems suspicious, do not continue.

Should I scan a QR code to pay a bill or fee?

Only proceed after confirming the recipient and payment details through a trusted channel. You can use the organization’s official app or find its website independently rather than relying on a code or message you cannot verify.

What if I scanned a code but did not enter anything?

Close the page and do not download files or provide information. If you did not interact further, there may be no account or payment details to secure, but stay alert for unexpected messages and report the code if it appears to be part of a scam.

Reviewed by our editorial team on October 12, 2026.