How to Read a QR Code Link Before It Reads You

#Security #Free APP

A QR code is a web address you can't read. That's the whole trick behind "quishing," the name security people gave to phishing through QR codes. A printed link that says paypal-refund-center.xyz would make most people pause. Encode the same address into a square of black dots and nobody gets the chance to pause.

The FTC has warned about this more than once, and the setups keep repeating: stickers pasted over the real code on parking pay stations, "we couldn't deliver your package" texts with a code to scan, flyers advertising a deal that lands on a fake login page. Some people have even received packages they never ordered, with a QR code inside asking them to "find out who sent it."

You don't need to stop scanning QR codes. You need about five seconds and a habit of looking at where the link goes.

Check the code itself first

Before you scan anything in public, look at the code as an object. On a parking meter, restaurant table or bike-share dock, run a thumb over it. A sticker has an edge you can feel. If the code sits slightly crooked, looks newer than the sign around it, or covers part of the printed text, assume someone put it there.

A code that shows up unasked, in a text, an email or a package you didn't order, deserves even less trust. Real companies rarely need you to scan something to fix a delivery or a billing problem. Open their app or type their address yourself instead.

Learn to find the real domain

This is the skill that matters most, and it takes about a minute to learn. Every web link has one part that tells you who actually owns the page: the domain just before the first single slash.

Read it from right to left, starting at that slash:

• usps.com/track: owned by USPS.
• usps.com.delivery-help.top/track: owned by whoever registered delivery-help.top. The "usps.com" at the front is decoration.
• www.paypa1.com/login: that's a number one where the L should be. Not PayPal.
• https://apple.com@198.51.100.7/: everything before the @ gets ignored. You'd actually land on a bare server address.

Scammers rely on people reading left to right and stopping once they see a familiar brand. Flip the direction and most fake links fall apart.

A few other things should slow you down: shortened links that hide the destination, odd domain endings you've never seen a real business use, a link that's absurdly long, plain http on a page that asks for a password or card number, and any link that wants to download an app or install a "profile" on your phone.

Why the iPhone camera isn't enough

The built-in camera does show a little banner with the domain when it spots a code. It's small, it's easy to tap through without reading, and it doesn't tell you whether that domain is a problem. Short links and look-alike spellings sail right past it.

That gap is what QR PreScan fills. It's a free iPhone app that scans a code (from the camera or a screenshot) and stops there. Nothing opens until you say so.

What you get instead is the destination with the real domain set in bold, so the right-to-left reading above happens for you. Then a verdict: Looks safe, Be careful, or Likely unsafe, along with the specific reasons. It flags brand names on someone else's domain, look-alike characters, @ tricks, raw IP addresses, short links, risky domain endings, unencrypted links, download and profile links, and code-running links like javascript:. The address also gets checked against Google's list of known phishing and malware sites.

Wi-Fi codes get handled too. You'll see the network name and security type before joining, and a warning if the network is open or uses old WEP encryption.

There's no account to create. The only thing that leaves your phone is the scanned web link, for that Google lookup. No subscription, no trial that turns into a charge.

What no scanner can promise

A scam site registered this morning might not be on any blocklist yet. And because QR PreScan never visits the link, it can't follow a short link to wherever it finally ends up. Treat a clean result as "no warning signs found," which is useful, but not a guarantee.

So keep one rule no matter what any app says: if a scanned code asks you to sign in or pay, close it. Go to the company's own app or type its web address by hand. Thirty seconds of extra effort beats a drained account.

Get QR PreScan free on the App Store (iPhone, iOS 17 or later).