Four checks
Step 1: Look at the code before you scan
Is it a sticker on top of something else? Raised edges, a second layer of paper or a code that sits crooked in its printed frame are warning signs. Note the label printed next to the code, like a meter or table number.
Step 2: Scan it with your phone camera
No app needed. A QRalo code opens a page on qralo.com/verify before the website it leads to. You can also open qralo.com/scan and point your camera at the code there.
Step 3: Check that the address bar says qralo.com
It has to be exactly qralo.com. Look-alikes such as qra1o.com, with the digit 1 in place of the letter l, aren’t us. A fake page can copy how our page looks. It can’t use our address.
Step 4: Read the result, then decide
Start with the colored edge and the title at the top of the card. Then compare three things with what’s in front of you: who signed it, where it goes and the printed label, like “Meter 0423”. If any of them is off, stop.
What the colors mean
The result card on the verification page always has a colored left edge, an icon and a title. These are the titles you’ll see.
BlueSigned by a verified account
Verified
Signed by a verified account
The signature matches and the code hasn’t changed since it was signed.
The account that signed the code verified its domain, and the code hasn’t changed since. Check that the destination and the printed label match what’s in front of you, then continue.
AmberLook closer before you continue
Signed
Signed by an account with no verified name
Nobody has confirmed who runs this account. Continue only if the address is what you expect here.
Check the link
Read the address before you continue
The signature is valid. Our automated link checks flagged something about this link.
Expired
This code has expired
Its end date has passed. Ask on site for a current code.
Something needs your judgement. The name may be unverified, the link checks may have flagged something, or the code may be past its end date. Continue only if the address is exactly what you expect. If in doubt, don’t pay.
RedStop
Withdrawn
This code was withdrawn
Don’t use it, and don’t enter payment details on any page it leads to.
Not verified
We can’t verify this code
It wasn’t issued through QRalo, or it was changed after signing.
Flagged link
Don’t open this link
The address is shown as text only.
Don’t open the link and don’t enter payment details. The code was withdrawn by its issuer or by QRalo, it wasn’t issued through QRalo or was changed, or the link was flagged as likely dangerous.
Grey gives no result. “This isn’t a QRalo code”, “This code can’t be checked right now” and “Couldn’t reach the verification service” tell you nothing about who made the code. Treat it like any ordinary QR code (see below).
What blue covers
Blue tells you who signed the code and that nobody changed it. Whether the website behind it is harmless is a separate question.
- Our link checks are automated. They use public lists of known phishing and malware sites where available, plus simple rules such as shortened links, unusual domain extensions or look-alikes of well-known brands. A brand-new scam page may not be listed yet.
- Compare the destination with what you expect, especially before you pay.
- If the card says Name not verified, whoever opened the account typed that name. Only a verified domain shows who runs it.
More detail is on our security page.
If it isn’t a QRalo code
Most QR codes are ordinary codes that nobody signed. That doesn’t make them fake, but nobody can tell you who made them. On qralo.com/scan, the address inside an ordinary code shows as text and doesn’t open.
- Read the address. Is it the official website of the business or the city you expect?
- Be wary of shortened links and of pages that ask for card details straight away.
- When in doubt, pay another way: at the machine, at the counter or in the operator’s official app.
If something looks wrong
- Don’t open the link and don’t enter payment details.
- Tell the business or the operator. Use a contact printed on the machine or found on their own website, never one from the sticker.
- On the verification page, tap Report a problem with this code at the bottom.
- If you’ve already paid, call your bank straight away, then report it to the police.