How do I see the full URL before opening a QR code on Android?

Tap the URL chip or tooltip that appears after your camera detects the code — most Android implementations give you a brief intermediate screen showing the complete URL. If your native camera app truncates it, switch to a dedicated QR scanner app that displays the full destination and lets you copy or inspect it before the browser loads anything.

Can a QR code URL preview be faked to look like a safe site?

Yes. Attackers use typosquatted domains (letters swapped to look like legitimate brands), lookalike Unicode characters, and misleading subdomains to make a URL appear trustworthy at a glance. The preview shows exactly what is encoded — it is not filtered. This is why character-by-character inspection of the root domain is necessary rather than a quick visual scan.

What QR scanner apps perform real phishing detection before opening a link?

Kaspersky QR Scanner and Trend Micro's QR scanner check URLs against known-malicious databases before loading them. Several antivirus suites (Bitdefender, Avast) also include QR scanning features with link reputation checks. These add meaningful protection beyond what the native iOS or Android cameras provide, which perform no real-time phishing classification at the preview stage. Why are shortened URLs inside QR codes considered a security risk? A shortened URL completely hides the final destination — the preview shows only the shortening service's domain, not where you will actually land. This makes it impossible to verify the target before loading it. Anyone who wants to scan a shortened QR code safely should paste the short URL into an expander tool first, or use a scanner app that follows and evaluates the redirect chain automatically.

What should a business do if someone sticks a fraudulent QR code over theirs?

Remove the tampered code immediately and audit whether other locations are affected. If you are using dynamic QR codes, check your scan analytics for unusual traffic spikes or geographic anomalies that may indicate the fake code was active. Replace all affected codes with new ones, and consider adding tamper-evident overlaminates or regular visual inspections as a preventive measure going forward.

QR Code URL Preview: How to Verify Before You Scan

Most people point their camera at a QR code and tap the notification without a second thought. That fraction-of-a-second decision is exactly what attackers count on. URL preview — the feature that shows you the destination before your browser opens it — is the simplest line of defence you have, and most users don't know how to use it correctly, or at all.

This post explains how URL preview works on each major platform, what it actually shows you, and the specific warning signs to check before tapping.

What URL Preview Actually Shows (and What It Doesn't)

When your camera or scanner app detects a QR code, it decodes the payload and surfaces a notification or banner containing the encoded URL. That preview is a direct readout of whatever was embedded in the QR code's data matrix — it is not a safety check. The platform is not telling you the link is safe; it is telling you where it points.

This distinction matters. A URL preview can show you a convincing-looking domain like paypa1.com or amazon-support-uk.co and your phone will display it without any warning, because neither iOS nor Android performs real-time phishing classification at the preview stage.

What URL preview does give you:

The raw destination URL before you commit to loading it
Enough information to spot typosquatting, lookalike domains, and suspicious paths
A moment of friction — which is, itself, protective

How to Enable and Read URL Preview on Each Platform

iPhone (iOS 16+)

Apple's built-in Camera app shows a yellow banner at the top or bottom of the frame. Tap the banner and it expands to show the full URL before opening Safari. The key setting is Settings → Camera → Scan QR Codes — confirm it is on. For a longer look, long-press the banner instead of tapping; this gives you a Share sheet with the URL displayed in full.

Android (varies by manufacturer)

Google Lens, Samsung's native camera, and most Android camera apps show a chip or tooltip with a truncated URL. The truncation is the problem: evil-redirect.net/amazon-giftcard/r… looks almost benign until you see the full path. Tap "Open" or the URL chip itself — most Android implementations give you a brief intermediate screen or allow you to copy the URL to inspect it. If yours doesn't, use a dedicated QR scanner app (see below) that surfaces the full URL before loading anything.

Third-Party Scanner Apps

Apps like Kaspersky QR Scanner, Trend Micro's QR scanner, and several others perform a lookup against known-malicious URL databases before the browser opens. They add a true safety layer that native cameras lack. The trade-off is that they require camera permissions for another app. For a business that regularly scans codes from external suppliers, event venues, or print materials from unfamiliar sources, the added step is worth it.

The Six-Second Inspection Checklist

Once you see the URL preview, run through these checks before tapping:

Domain spelling: Compare letter-by-letter. Common swaps include rn for m, 1 for l, and 0 for o. The full domain is what matters — not the path.
TLD appropriateness: A UK retailer using .ru or .xyz is a red flag. Know what TLD the organisation actually uses.
Subdomain vs. domain: amazon.fake-login.com has amazon as a subdomain — the actual domain is fake-login.com. The rightmost part before the first single slash is the real domain.
HTTPS presence: HTTP is not automatically malicious, but any page asking for credentials or payment over plain HTTP should be refused.
Shortened URLs: bit.ly, tinyurl, t.co, and similar services hide the destination entirely. Use a URL expander (unshorten.me works well) before opening.
Context match: Does the URL match the brand and purpose of the QR code's physical context? A parking meter code going to a .io startup domain warrants suspicion.

What Businesses Printing QR Codes Should Do

If you are on the other side — placing QR codes on menus, packaging, or signage — your readers' ability to verify your destination is a trust signal, not just their problem. There are two practical steps:

Use a recognisable domain as your redirect base. If you use a dynamic QR platform, check whether it supports custom domains. A scan going to go.yourbrand.com instead of a generic short-link domain gives scanners something they can actually verify. You can read more about what builds scanner confidence on the landing page trust signals guide.

Prefer dynamic codes where you control the destination. With a dynamic QR code, you can update the URL if something goes wrong — a compromised redirect, a domain that expires, or a page that gets flagged. Static codes are permanent; once printed, you cannot recover if the URL is later flagged as suspicious.

If you're newer to deploying QR codes for your business and want to ensure you're using the right setup from the start, our QR code generator supports custom domains and live redirect management for exactly this reason.

The QR code verification checklist is worth bookmarking as a companion to what's covered here — it covers physical tamper signs and contextual checks that go beyond the URL alone.

Key Takeaways

URL preview shows the destination but does not confirm it is safe — you must read the URL actively.
The most important element to inspect is the root domain (the part immediately left of the TLD), not the subdomain or path.
iOS long-press and Android URL chips both surface the full URL if you interact with them before tapping through.
Shortened URLs in QR codes are a structural risk; expand them before opening.
If you publish QR codes, use a recognisable custom domain and dynamic codes so you can respond to any compromise.