- The order in which to check where a QR code leads
- Why apoul.jp.example.com is not apoul.jp
- What to do next, depending on whether you entered a password or card details
The short answer
Parking meters, restaurant tables, emails and text messages: QR codes turn up everywhere, but each one works just like a link. Whether to open it depends not on the pattern but on the destination it shows and on what the page then asks you to do. If you are asked to pay or sign in, do not type anything there; check the same notice through the official app or a contact point you already know.
The pattern does not tell you where it goes
A QR code packs text into a square pattern. Most of the time that text is a URL (the address of a web page), and no one can tell where it leads by looking at the pattern.
The US Federal Trade Commission (FTC), a consumer protection agency, warned in December 2023 about scammers sticking their own codes over legitimate ones, and about emails and texts that urge you to scan a code because of a failed delivery or an account problem. The alert is written for US consumers, but the checks it describes apply elsewhere too. Phishing (luring people to a fake page to enter their details) carried out by text message is also called smishing.
For example, if the edge of a QR sticker on a parking meter is peeling, or a text about a "redelivery" you never expected comes with a QR code, pause before you scan.
Read the right-hand side of the domain
Many phones show the URL after scanning, before opening the page. Read it before you open it, and check the address bar again once the page loads, because you may be redirected along the way.
The part to look at is the domain. A domain is a name on the internet, written between "https://" and the first "/". The owner is identified by the right-hand side.
| URL shown | Part that identifies the owner |
|---|---|
| https://apoul.jp/news/ | apoul.jp |
| https://apoul.jp.example.com/login | example.com |
"apoul.jp.example.com" is a subdomain that the owner of example.com can create, and it is a different domain from apoul.jp. Containing a company name, or something that looks like a domain, does not make a page that company's own. The FTC also advises watching for misspellings and swapped letters.
The pattern does not tell you the destination, and a company name inside the URL proves nothing.
The padlock shows the connection is encrypted, not that the other side is genuine.
The padlock and shortened URLs
HTTPS and the padlock show that the connection is encrypted. They do not show that the other party is a legitimate company; fake pages can use HTTPS too.
A shortened URL replaces a long address with a short one. It hides the destination, but legitimate notices use them as well, so a shortened URL alone does not make something a scam. The harder the destination is to see, the more reason to check through another route before signing in or paying.
If you have already entered something
Scanning a code or opening a page does not by itself mean harm has been done. Calmly work out what you entered or installed, and act accordingly.
- You entered a password: sign in through the official app or an address you already know and change the password. Also change it on any other service where you reused it, and turn on two-step verification if available.
- You entered card details: contact your card issuer using the number on the back of the card or another channel you trust, and follow their advice on blocking the card and checking statements.
- You installed an app or a profile: on a work device, stop and contact your IT contact rather than continuing on your own.
Summary
Checklist
- Read the URL shown after scanning, before opening it
- Looked at the right-hand side of the domain to see if you know the owner
- Did not treat the padlock alone as proof the site is genuine
- Checked payment or sign-in requests through the official app or a known contact
- Stopped before scanning codes that look covered over or arrived unexpectedly
One thing to check today
When a notice asks you to enter details or pay, check in the official app whether the same notice appears there, instead of going through the QR code.