The practical answer
Treat an unfamiliar QR as an unfamiliar link. Preview the address, check the context and use a known website or app if the destination unexpectedly asks for money, a password or a one-time code. A familiar logo and an HTTPS address are not proof of legitimacy.
Checks before you continue
| Situation | What to look for | A useful next step |
|---|---|---|
| A code on a public sign | A replacement sticker or unusual destination | Confirm the sign with the venue or use its known website. |
| An urgent request in an email | Pressure to pay or verify an account | Contact the organisation using details you already trust. |
| A sign-in or payment screen | Whether the request fits what you intended | Leave and open the genuine app or site directly if unsure. |
| A scan shows a short redirect URL | The final website is not yet visible | Do not treat a decoded short link as verification of its destination. |
Treat a QR code like a link
A code can lead to a real business page or a convincing imitation. A familiar logo does not establish who controls the destination. Use a scanner that previews the decoded information. Our image scanner shows what it reads and waits for you to choose whether to open it.
Inspect the actual domain
Read the website name carefully, including spelling and unexpected extra words. A padlock or https connection means the connection is encrypted; it does not prove that the business is genuine. If a code asks for payment or a password unexpectedly, open the organisation’s known website or app yourself.
Check where the code is displayed
Look for a replacement sticker, damaged sign or instruction that seems out of place. If a payment code is on a venue counter, confirm it with staff. For a message that creates urgency, slow down and contact the organisation through details you already trust.
If you already opened the link
Opening a page and providing information are different events. Stop if something feels wrong. If you entered payment details or transferred money, contact your bank promptly using a trusted number. Change an exposed password through the genuine service and use its account-security process. Scamwatch provides current Australian reporting and recovery guidance.
For business owners
Inspect printed codes as part of normal venue checks, particularly on public signs and unattended displays. Put your readable website address beside the code and keep a record of the intended destination. Train staff to help customers who prefer a different way to access information or pay.
Example: a menu sign that opens an unexpected payment page
If a sign says “View the menu” but the page immediately demands card details, pause and ask venue staff whether it is their intended page. A QR scanner can reveal the encoded link, but it cannot establish that the sign has not been replaced. The mismatch between the promised action and the requested information is a reason to check before continuing.
Illustrative example, not a customer case study.
A checklist to use on your next code
- Read the destination instead of relying on the logo around the code.
- Use a known contact route to verify unexpected requests.
- If money or account details were exposed, follow the current Scamwatch recovery guidance promptly.
- Report suspicious codes through the relevant venue or platform and Australian reporting channels.