Skip to content
QRaware

Scanned a suspicious QR code?

I Scanned a Scam QR Code — What Should I Do?

Don't panic. What you should do depends on what happened after you scanned it.

I only scanned itI opened the websiteI entered a passwordI entered bank detailsI entered personal informationI entered a verification codeI downloaded somethingI installed an appI made a payment

Scanning a QR code does not automatically mean your phone has been hacked. The risk depends on where the code led and what you did next. Use the sections below to find the steps that match your situation.

This page is for people who have already interacted with a suspicious QR code. If you want the broader explanation first, read the full QR Code Scams guide.

Quick orientation

Ask yourself:

  1. Did I only scan, or did I open a website?
  2. Did I enter a password, code, personal details or payment information?
  3. Did I download a file or install an app?
  4. Did I send money or approve a payment?

Then jump to the matching section.

I only scanned it

If you scanned the code and immediately closed the camera or preview without opening a site, entering information or downloading anything, your risk is usually lower.

Suggested steps

  • Close any preview or browser tab that opened
  • Do not return to the destination
  • Make a note of where you saw the QR code, if useful for reporting later
  • Continue with normal caution online

I opened the website

If a page opened but you did not enter information, download files or approve payments:

Suggested steps

  • Close the tab or browser immediately
  • Do not enter any details if the page reappears
  • Clear the page from recent tabs so you do not reopen it by accident
  • Be alert for follow-up messages that try to continue the scam

Check whether the address looked legitimate. Fake sites often use lookalike domains, odd spellings or unexpected redirects. Learn more about quishing.

I entered my password

If you entered a password on a page reached through the QR code, treat that password as compromised for that account.

Password exposure checklist

  • Change the password on the affected account immediately
  • If you reused that password elsewhere, change it on those accounts too
  • Turn on multi-factor authentication if available
  • Review recent account activity for unexpected changes
  • Watch for emails or texts asking you to 'confirm' more details

I entered bank or card details

If you typed card numbers, banking login details or other payment credentials:

Payment details checklist

  • Call your bank or card provider straight away
  • Explain that you may have entered details on a fraudulent site
  • Ask them to monitor or secure the account or card as appropriate
  • Watch statements for unfamiliar transactions
  • Keep notes of times, amounts and any reference numbers

I entered personal information

Personal information can include your full name, address, date of birth, national identifiers, or answers to security questions.

Personal information checklist

  • Write down exactly what you shared, if you can remember
  • Be alert for follow-up scam calls, texts or emails that use those details
  • Do not confirm more information to unexpected contacts
  • Consider extra caution with identity-related accounts and credit monitoring options available in your country
  • Report the incident through relevant local fraud or consumer channels if appropriate

I entered a verification code

One-time passcodes (OTPs), SMS codes and authenticator codes are often used to take over accounts.

Verification code checklist

  • Secure the account tied to that code as soon as possible
  • Check for new devices, sessions or forwarding rules you do not recognise
  • Turn on or tighten multi-factor authentication settings
  • Be wary of callers who already know part of your information and ask for another code

I downloaded something

If a file downloaded after the scan:

Download checklist

  • Do not open the file if you have not opened it yet
  • Delete the file
  • Empty your device recycle bin or equivalent if appropriate
  • Run a reputable malware scan using security tools you already trust
  • Update your device software

If you already opened the file, continue to the next section and consider device security checks.

I installed an app

Unexpected apps installed after a QR scan can be risky.

App install checklist

  • Delete or uninstall the app
  • Review app permissions on your phone
  • Check whether the app requested accessibility, device admin or unusual privileges
  • Change passwords for important accounts from a trusted device
  • Monitor for unexpected messages being sent from your accounts

If you cannot remove the app or your device behaves strangely, contact official support channels for your phone platform or a trusted technician.

I made a payment

If you paid money, transferred funds or approved a payment request:

Payment checklist

  • Contact your bank or payment provider immediately
  • Tell them you believe the payment may be linked to a scam
  • Ask what recovery or protection options are available
  • Save screenshots, emails, SMS messages and payment references
  • Avoid sending more money to 'unlock', 'release' or 'recover' funds — that is a common follow-on scam

What not to do

  • Do not send more money to fix the first payment
  • Do not give remote access to your device to unexpected callers
  • Do not reuse the suspicious page to “check whether it was real”
  • Do not ignore account alerts hoping they will go away

After you stabilise the situation

Once the immediate steps are done:

A calmer way to think about it

You are not alone. QR codes are designed to be fast, and scammers rely on that speed.

The useful response is not shame. It is a clear sequence:

Stop. Look. Verify. — and if something already went wrong, take the next practical step for your situation.

Related guides