Fake Coupon Links and QR Codes: How to Check an Offer Safely

Before you open a coupon link or scan a QR code promising a discount, check the offer through the retailer’s official app or a website address you already know. If you can find and use the coupon there, you don’t need the link in the message. If you can’t, contact the retailer through its usual customer service channel before sharing information or paying anything.

A familiar logo, a friend’s forwarded message, or a printed QR code doesn’t prove an offer is genuine. The useful question is: can you confirm who’s offering the discount and where you’re being sent?

Check the offer without following its link

Keep the message closed while you open the store’s app or type its known website address into your browser. Look in the coupons, offers, or rewards section. For a manufacturer’s coupon, start with the manufacturer’s own website.

Compare the details, not just the discount amount. Check which products qualify, the expiration date, any minimum purchase, and whether the offer requires a rewards account or applies only to new customers. A real promotion can still be the wrong coupon for your purchase.

Not finding the coupon doesn’t automatically make it fake; some promotions are personalized. It does mean you need another way to confirm it. Ask customer service whether the offer and its redemption website are authorized. Use contact information from the official app or known website, not the suspicious message.

The FTC identifies coupons for free merchandise as one possible phishing lure. Its advice is to contact a company through a website or phone number you know is genuine when a message seems suspicious.

Inspect the destination before opening it

On a computer, hovering over a link usually reveals its destination without opening it. When your phone’s camera recognizes a QR code, inspect the address it displays before tapping the prompt. If the address is shortened, cut off, or otherwise unclear, use the retailer’s official app or known website instead.

Look for misspellings, substituted letters, and extra words in the website name. A brand name somewhere in a long address isn’t enough: it could appear in a page path on an unrelated website. Some genuine promotions use outside services, so an unfamiliar address is a reason to verify the offer independently, rather than guess.

A padlock or an address beginning with HTTPS doesn’t settle the question. It means the connection is encrypted; scammers can use encrypted websites too.

Treat QR codes like links

A QR code can hide a destination you would question if it appeared as plain text. The FTC warns that malicious QR codes can lead to spoofed websites that capture information you enter. It has also received reports of scammers covering legitimate codes with their own.

For a code on a store sign, check for a sticker placed over another code or anything that looks altered. Ask an employee if you’re unsure. A clean-looking sign still isn’t proof, so inspect the destination too.

Avoid scanning unexpected codes sent by text or email, especially when the message pressures you to act immediately. Seeing a camera preview is different from opening the destination or submitting information. You can stop at the preview and check the promotion another way.

Pause when claiming the coupon becomes the risky part

Pay attention to what the offer asks you to do next. These requests deserve an independent check before you continue:

• Pay to unlock the coupon. Don’t enter card details into an unverified page to cover a small “release,” “verification,” or “processing” charge.
• Provide sensitive information. A coupon claim asking for your bank login, Social Security number, or an account security code is a reason to stop.
• Install something first. Don’t install an app, browser extension, or other software from a coupon message to reveal a discount.
• Keep completing unrelated steps. Repeated surveys, requests to forward the offer, or pages that keep redirecting you are reasons to leave and verify the promotion elsewhere.

A legitimate rewards program may ask you to sign in or provide an email address. Do that through the verified app or website you opened yourself. A countdown timer shouldn’t change that decision.

For example, suppose a forwarded message promises a free grocery item, but its claim page asks for a card to pay a small fee. Leave that page and check the store’s app. If the offer isn’t there, ask customer service about it. Don’t make the payment just to find out whether the coupon works.

If you already opened a suspicious offer

Opening a page alone doesn’t establish that an account was compromised. Close it, don’t accept downloads or permission requests, and choose your next step based on what happened.

• You entered a password: Change it through the real service immediately, along with any accounts where you reused it. Enable multifactor authentication where available.
• You entered card details or paid: Contact your card issuer promptly through its official app or the number on your card. Explain what happened and ask about securing the card and reversing any fraudulent charge.
• You downloaded something or allowed device access: Follow the FTC’s device recovery guidance. For a computer, update its security software and run a scan. Use trusted manufacturer support if you need help.
• You shared identity information: Visit IdentityTheft.gov for recovery guidance appropriate to the information exposed.

The FTC’s steps to take after a scam cover these situations. In the United States, you can also report the offer at ReportFraud.ftc.gov.