A Checklist That Fits Where You Found the Code
Generic advice — be careful — is easy to ignore because it does not say what to actually do. The risks of a code on a street poster are different from the risks of a code in an email: the poster can be tampered with by a sticker, while the email can be spoofed by a familiar name. A checklist tuned to the context turns vague caution into concrete actions: check the sticker, check the sender, preview the link, verify the recipient.
The three checks that apply everywhere
Whatever the context, three checks always apply. First, preview the destination before opening it — every modern phone shows the link. Second, compare the domain in that preview against the business or sender you expect. Third, never enter a password, payment, or personal detail on a page reached from a code you have not verified. Those three checks stop most QR attacks on their own.
Using this checklist with others
Print it for a shop counter, a classroom, or a staff room. Tick boxes make the routine visible: a new team member can follow the same steps a security reviewer would. For payment contexts, add your own rule — a second person verifying the recipient — on top of the list.
- Post the checklist where codes are scanned, not in a policy document nobody reads.
- Re-check after any change: a reprinted poster or a new supplier means a new checklist run.
- If one check fails, stop. A failed check is the checklist working, not an inconvenience.