QRLoom
Free tool · no sign-up

QR Code Safety Checker

This free tool checks a QR code before you open it or pay. Upload a photo, use your camera or paste the text, and it shows where the code really goes, whether the site imitates a bank, and whether a PromptPay code was tampered with. Images are decoded on your device. Always confirm the payee name in your banking app.

The image is decoded on your device and never uploaded.

What we check

Links and domains

Shows the real website name in large type, follows short links to their final destination, and warns about look-alikes of Thai banks (Kasikornbank, SCB, Krungthai and others), fake government domains, mixed-alphabet tricks and unencrypted links.

PromptPay / Thai QR Payment

Reads the payment data, verifies the built-in checksum (CRC) to detect edited or broken codes, and shows whether money goes to a mobile number, national ID or e-wallet (last 4 digits only) plus any pre-filled amount.

Wi-Fi, calls, texts and more

Tells you what a code will do before it does it: join an open Wi-Fi network, dial a premium-rate number, run a call-forwarding code, or text a paid short code.

Fake PromptPay stickers over a shop’s real code

Scammers print their own PromptPay QR and stick it over the real one at shops, car parks and kiosks. These fake codes are technically perfect, so no checker can tell you whose account they pay. The reliable defence is to read the account name in your banking app before you confirm, and to look for a sticker layered on top.

Read the full guide to spotting fake QR codes

Privacy

QR images are decoded in your browser and never uploaded. For web links, only the link is sent to our server so we can follow its redirects (we never load the page content), and nothing is stored unless you choose to report it.

Frequently Asked Questions

How can I tell if a QR code is safe?

Nothing can guarantee it, but check that the link goes to the right domain (a real bank uses its own domain; Thai government sites end in .go.th), that it is not a short link or a misspelled look-alike, and that no sticker has been placed over the original. For payment codes, always check the payee name in your banking app before confirming.

How do I check a PromptPay QR code for scams?

Scan or upload it here. We check whether the code was edited or damaged (checksum mismatch) and show the recipient type and last 4 digits. A brand-new fake code will still pass, so confirm the account name in your banking app matches the shop before you pay.

Can you get hacked just by scanning a QR code?

Scanning alone is very rarely harmful. The danger comes from what you do next: entering passwords, OTPs or card details on the page, installing an app from the link, or paying a fake account. This checker shows you the destination first and never opens it automatically.

Is my uploaded image stored?

No. The image is decoded on your device and never sent to our servers. For web links, only the link itself is sent so we can follow its redirects.

What should I do if I already paid a scammer in Thailand?

Call your bank immediately and ask them to freeze the receiving account, then call the 1441 anti-online-scam hotline (24 hours) and file a report at thaipoliceonline.go.th. Keep your transfer slip and screenshots as evidence.

More QR tools