QR code safety: help an aging parent check before opening or paying

01

Start with the task your parent wanted to complete#

A parent trying to pay for parking may feel rushed by a queue, a time limit, or a small screen. Start by asking what they intended to do and whether they want help. Let them hold the phone and make the decision. A useful opening is: “We can check where this goes before we do anything else.”

Agree on the expected result first. A restaurant menu should help them read the menu. A parking payment should match the actual operator and location. If the next screen changes the task into signing in, downloading software, or giving unrelated information, pause.

This guide's check-and-pause routine is an editorial suggestion for families. It is not a technical test that certifies a code as safe.

02

Pause at the camera link on iPhone or Pixel#

On an iPhone, open Camera and point it at the code. Apple describes a link that you tap to open the content. On a Google Pixel, the Camera app similarly shows a bubble or link after recognizing the code; tapping it opens the destination. You do not need to take a photo on Pixel.

Use that pause to look at the displayed destination before tapping. Google says Pixel's Camera scan suggestions setting must be enabled for camera recognition. Other Android brands and scanning apps can behave differently, and a preview may not show the complete address.

If the phone does not make the destination clear, stop there and use another route. Do not install an unfamiliar scanner merely to complete a payment.

03

Check the destination without treating the preview as a guarantee#

The US Federal Trade Commission advises checking QR destinations for misspellings or substituted letters. Compare the address with a website you already know belongs to the organization. A familiar word somewhere in an address is not enough to establish that match.

If the address is shortened, unfamiliar, cut off, or too small to read comfortably, choose a known app or verified website instead. Do not open it just to investigate where it might lead.

HTTPS describes a protected connection, not the honesty of the business. Google's Chrome guidance still tells users to check the site name before sharing sensitive information, even over a secure connection. A polished page and recognizable logo are not substitutes for that check.

04

At a parking meter, verify the operator and location#

The FTC's September 2026 parking advisory describes scammers putting their own QR codes over legitimate ones. Before scanning, look for an added sticker or a code that seems out of place. A tidy sign is not proof that it has not been altered.

If something looks wrong, leave the code alone and find another payment method through the parking operator's independently verified website, an app your parent already uses for that operator, or on-site staff. Availability differs between car parks.

Before approving payment, compare the location code, vehicle, parking period, amount, and payment recipient with the intended purchase. Keep the legitimate confirmation. A suspicious QR payment screen is not evidence that parking has been paid; resolve the parking session through the real operator.

05

Leave unexpected message and package codes alone#

An unexpected text about a missed delivery, account problem, or urgent password change deserves a separate check. The FTC advises avoiding QR codes in unexpected emails or texts, particularly those pressing for immediate action. Open the carrier's or provider's known app yourself rather than following the message.

The agency also warns about unsolicited packages containing a code supposedly identifying the sender or explaining a return. Ask family members through familiar contact details if they sent anything. Check existing order records independently.

You do not need to solve the mystery by scanning. Keep questions about returning or retaining a package separate from the code, and use the relevant retailer or local consumer authority if needed; package rules differ by country.

06

Make the alternative easy enough to use#

Before the next outing, ask which services your parent regularly needs. Together, save a verified parking operator or delivery website as a bookmark, or check an already installed official app. For a familiar website your parent uses regularly, follow our home screen shortcut guide. Practice reaching that route from the home screen.

At a restaurant, asking for a paper menu or staff assistance is also a reasonable choice. The goal is to finish the original task comfortably, not to prove that your parent can decode every web address.

If help is needed, contact a familiar person using a saved number. For financial concerns, the FTC recommends a bank's official app, established website, recent statement, or the number on the card. Avoid support numbers supplied by the questionable page or a search advertisement.

07

If they already scanned, establish what happened next#

Ask calmly and take one stage at a time. A scan by itself is not evidence that money was paid or that an account was compromised. Equally, closing a page cannot undo information already submitted.

Use the furthest action reached to decide what needs attention. If your parent is unsure, write that uncertainty down instead of guessing.

• Only a camera link appeared: leave the scanner without opening it and use a trusted route.
• A page opened: close that tab with the browser's controls. Do not use its support number, install prompt, or payment button. Check for system and app updates through the phone settings and official app store.
• Details or a verification code were entered: move to the real account provider's security or recovery process.
• A file, app, profile, or remote-access permission was added, or money was paid: treat that as a separate issue requiring the relevant device, account, or payment-provider response.

08

Respond to exposed details, payment, or installed software#

If a password was entered on a suspected fake site, change it promptly through the genuine service, and change it anywhere else it was reused. Review the provider's security options and enable multifactor authentication where available. If a code was shared or access was lost, use the provider's official recovery support.

If card information was entered or a payment was made, contact the card issuer, bank, or payment service promptly through a verified route. Explain what was shared or approved, ask how to protect the account, and ask whether the transaction can be reversed. Recovery is not guaranteed.

If software or access was added, get help through the device maker's genuine support. Google's Android guidance includes Play Protect, updates, and removing untrusted apps. Do not follow a suspicious page's “cleanup” instructions. Keep account recovery on another trusted device if you suspect the phone is compromised.

09

Finish with one short family reminder#

Write a reminder in your parent's preferred words: “Pause. Check the destination. Use my known app if unsure.” Practice with a code from a source you have independently verified, while there is no queue or payment pressure. Ask your parent to explain where they can stop.

If something went wrong, preserve the relevant message, receipt, date, and payment details privately. Avoid circulating passwords, codes, or full card numbers in family chats. Agree who will help with the next step and when you will check back.

In the United States, suspected scams can be reported to ReportFraud.ftc.gov and identity-theft recovery guidance is available at IdentityTheft.gov. Elsewhere, use your country's official fraud-reporting or consumer-protection service.