What is happening here
A typosquat domain is a web address that looks almost identical to a real brand, with one letter swapped, added, missing, or replaced by a lookalike character. A QR code makes this harder to catch, because you never type the address yourself.
Typosquat codes appear on fake signs, in messages, and in ads that mimic a known brand. The page may copy the brand colours and layout, so the only clue is the address itself.
Red flags to check before you scan
- The domain has a small spelling change: a swapped letter, a doubled letter, a missing letter, or a hyphen that does not belong.
- The domain uses a different ending than the brand normally uses, or adds an extra word such as support, secure, or verify.
- Characters look slightly odd, such as a zero in place of the letter O, or a lookalike character from another alphabet.
- The page asks you to sign in or pay before showing any content that proves it is the real brand.
- The QR code appears in a context the real brand would not use, such as a random flyer or an unexpected message.
Verify before you trust it
1. Read the domain character by character in the URL preview before you open it.
2. Compare it with the domain you have bookmarked or the one printed on the brand official materials.
3. Use a typosquat checker to compare the domain against common typo variants.
4. Type the brand address yourself instead of following the code when anything looks off.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR checksum generator](/qr-checksum-generator) before you trust a code you did not expect.
- Inspect the code with the [QR payload inspector](/qr-payload-inspector) before you trust a code you did not expect.
- Check the address with the [QR offline verifier](/qr-offline-verifier) before you trust a code you did not expect.
- Practise spotting patterns with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
- Review the chain with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
- Keep a record with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Plan protection with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
