What should users do when a QR code leads to an unexpected website or login page?

What to check before treating a QR destination as safe

A QR code is only a shortcut to a destination, not proof that the destination is legitimate. If it leads somewhere unexpected, the safest response is to stop, verify the intended site through a trusted path, and assume the code may have been swapped, spoofed, or redirected.

The key question is not whether the page looks polished, but whether the destination matches what you expected. A mismatch in domain, login flow, branding, or payment path is enough reason to back out and re-enter the site independently from a bookmark, saved link, or direct search result.

In practice, the risk is highest when the QR code is asking for credentials, payment, or any other sensitive action. A well-timed fake login page can capture passwords, MFA codes, or card details before the user realizes the page was not the intended service.

Why unexpected QR redirects are dangerous

Unexpected QR destinations are a common trust-abuse pattern because they bypass careful typing and move the user straight into a web session. That makes it easier for a malicious actor to mimic a bank, parcel tracker, retailer, help desk, or cloud sign-in page and collect whatever the user enters.

Users should pay attention to the full domain, not just the page design. Shortened URLs, lookalike domains, misspellings, and subdomains can make a page appear familiar while sending credentials to an attacker-controlled site. If the QR code opened a login page you did not deliberately navigate to, treat that as a warning signal.

For high-value accounts, the safer habit is to avoid acting from the QR result at all and instead use phishing-resistant sign-in methods and verified entry points. That reduces the chance that a QR redirect can capture credentials through a convincing but fraudulent page.

Safer user actions when the site does not match expectations

If the destination is unexpected, close the page before entering any data and verify the intended address from a trusted source. If you already opened the page, do not interact with forms, embedded payment widgets, or one-time code prompts until you have confirmed the site is genuine.

When the QR code appears in a work, finance, or support context, users should confirm the destination with the issuer through a known channel. For example, a company can publish a verified portal link, and the user can compare the QR destination against that reference instead of relying on the scan alone.

Good habits also include using saved bookmarks for recurring services and checking for obvious signs of redirection, such as a login page that appears before you expected one. If the site is legitimate but the QR path is odd, the safest move is still to abandon the scan and access the service from a trusted starting point.

Risk and Threat Considerations

Unexpected QR destinations are risky because they turn a physical object into an authentication trap. A malicious sticker or tampered poster can send users to a convincing clone page, where the attacker only needs one rushed submission of a password, payment card, or MFA code to create a real compromise.

Failure mechanism: The attacker replaces or intercepts the QR destination, then relies on user trust and speed to move the victim into a fake login or checkout flow before the mismatch is noticed.

Impact: The result can be credential theft, account takeover, payment fraud, or exposure of additional session or identity data if the user continues past the first warning sign.

Practitioner Guidance

What to verify: Check the full destination domain, the login path, and the expected purpose of the page before entering any information. If the page asks for credentials, payment, or a recovery code, verify it through a second trusted route first.

Decision rule: If the QR scan does not lead to the site or flow you expected, stop using that page immediately and reach the destination from a known-good source. Do not try to “test” the page by submitting partial details.

What good looks like: Users treat QR codes as convenience shortcuts, not as trusted proof of identity, and they switch to direct navigation whenever the result is unfamiliar, inconsistent, or requests sensitive input.

Practitioner takeaway: The safest response is not to inspect the suspicious page longer, but to break the trust chain and re-enter the intended service from a verified path.

Related resources from NHI Mgmt Group

• What should teams do when a QR code leads to a suspicious login flow?
• What happens when users enter a malicious device code on a trusted login page?
• What happens when a spoofed email leads users to a fake login page?
• What happens when an executive scans a malicious QR code and enters credentials on the fake login page?