Why QR Codes Need a Destination Check
A QR code hides the address until you inspect it
A QR code is a way to encode information, often a web address. The printed square does not show the destination in readable form, so a sticker can be placed over a legitimate code or a code can be copied onto an unrelated poster. Scanning is not the same as approving the link, and the page that opens may redirect again.
Use the phone camera or a reputable built-in scanner that previews the destination before opening it. Read the full hostname carefully. In “brand.example-download.test,” the controlling domain is “example-download.test,” not the word “brand.” Look for misspellings, extra words, strange subdomains, and URL-shortening services that conceal the final address. If the scanner opens a page immediately without showing the address, close it and use a scanner with a preview.
A practical scenario: a printed notice appears to carry an operator’s QR code, but the code is a sticker with slightly different colors. The preview leads to a short URL. Do not follow it to “see what happens.” Instead, locate the organization through an independently known website or contact channel and ask whether that exact hostname and campaign are theirs. A familiar logo or location is not confirmation.
Even a genuine destination may be compromised, outdated, or point to content that has since changed. HTTPS only encrypts the connection to the current hostname; it does not authenticate a brand relationship. Never enter a password, payment information, or one-time code on a page reached through an unverified QR link. Be especially wary of prompts to install an app, allow a profile, or disable device security.
If a code is displayed in a public place, inspect whether it appears pasted over another code and consider reporting a suspicious alteration to the venue manager. Do not scan a code from a message that pressures you to act immediately. If the link is work-related, use your organization’s established security reporting route.
For a casino-related QR code, a destination matching a related brand string does not establish that it is an approved domain or genuine download page. PAGCOR’s dated brand-and-domain lists do not authenticate a current app package, store listing, download link, or QR destination; those require matching publisher and file evidence. Treat the link as unresolved until the publisher confirms it through a separately verified channel.
Sources: CISA, phishing and suspicious-link guidance (cisa.gov); Apple Support and Google Android Help, camera/QR scanning behavior (support.apple.com; support.google.com/android). Scanner features vary by device and software version.
Official source links: PAGCOR licensing index and dated brand/domain lists.