QR Code Safety: Check the Destination Before Signing In

September 30, 2026

Quick answer: A QR code is a way to encode information such as a web address; it does not authenticate the destination. Preview the link, verify the domain and open a trusted app independently before entering account or payment details.

QR codes appear on menus, parcels and shop counters in Pakistan. A printed code can be replaced or point somewhere unexpected, so judge the destination and requested action rather than the neatness of the sticker.

What to do, step by step

Use your device's normal camera or a trusted scanner and inspect the preview. Do not install an unknown scanner just because a poster asks you to.
Check the full domain for misspellings or misleading subdomains. A familiar brand word somewhere in the address is not sufficient verification.
For a sensitive login or payment request, open the official app or known website independently and find the task there.
If paying a merchant through a legitimate app, confirm the recipient and amount on the app's final screen before approving.
If a code asks for an OTP, recovery code, unusual app installation or urgent password entry, stop and verify through a known contact route.

HTTPS is only one check

An encrypted connection can still lead to a fraudulent destination. A QR code also does not establish that a physical sticker belongs to the business beside it. Ask the merchant to confirm an unfamiliar payment destination instead of treating a successful scan as approval.

Frequently asked question

Is scanning alone the same as making a payment?

Usually additional steps are required, but inspect what your app is doing. Never approve an unfamiliar recipient or request merely because you scanned a code.

Roman Urdu summary

QR scan honay ka matlab link genuine hona nahin. Domain, recipient aur amount alag verify karein.

Official references

Google: Check whether a connection is secure

Prepared for readers in Pakistan on 30 September 2026. Software labels and feature availability can vary by device, version and account; use the linked official instructions for your setup.