What is happening here
A malicious redirect is a QR code that sends you through one or more hops before landing somewhere harmful. The first destination can look innocent, which is why checking only the first link is not enough.
Redirects are normal on the web, and that is what makes them useful to attackers. A code can point to a short link, a tracking service, or a compromised page, and each hop can change where you end up.
Red flags to check before you scan
- The QR destination is a short link, tracking link, or redirect service that hides the final page.
- The page you land on does not match what the sign, message, or code promised.
- The browser address changes several times in a row before the page settles.
- The final page asks for sign-in or payment even though the code promised information or a menu.
- The domain of the final page is unrelated to the organisation named on the sign.
Verify before you trust it
1. Use a redirect chain viewer or a link expander to see each hop before you open the final page.
2. Read the full final address, not just the first hop, and compare it with the expected domain.
3. If the chain passes through unfamiliar domains, stop and reach the destination by typing the official address.
4. Treat a code that bounces through unrelated sites as untrusted, even if the last page looks polished.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR redirect chain viewer](/qr-redirect-chain-viewer) before you trust a code you did not expect.
- Inspect the code with the [QR scan log](/qr-scan-log) before you trust a code you did not expect.
- Check the address with the [QR typosquat checker](/qr-typosquat-checker) before you trust a code you did not expect.
- Practise spotting patterns with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
- Review the chain with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Keep a record with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
- Plan protection with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
