What is happening here
An open redirect is a real, trusted website that forwards visitors to an address supplied in the link. Attackers abuse this by building a QR code whose first hop is a trusted domain, while the final hop is a fake login or payment page.
The trick works because the preview shows a domain people recognise. The dangerous part is buried in the parameters after the domain, where most scanners never look.
Red flags to check before you scan
- The QR destination is a long address on a trusted domain with a redirect, next, return, or URL parameter.
- The parameter points to an unrelated or unfamiliar domain.
- The final page asks for sign-in or payment even though the code promised something routine.
- The message or sign leans on the trusted brand name while the real destination is different.
- The address contains several nested links or encoded text that hides the final hop.
Verify before you trust it
1. Inspect the full address, including the parameters after the question mark, before you open it.
2. Look at where the redirect parameter points and compare that domain with the brand you expect.
3. Use a redirect chain viewer to list each hop in plain form.
4. Reach the brand by typing its address yourself if the redirect target looks wrong.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR phishing pattern trainer](/qr-phishing-pattern-trainer) before you trust a code you did not expect.
- Inspect the code with the [QR checksum generator](/qr-checksum-generator) before you trust a code you did not expect.
- Check the address with the [QR payload inspector](/qr-payload-inspector) before you trust a code you did not expect.
- Practise spotting patterns with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Review the chain with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
- Keep a record with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
- Plan protection with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
