If you scanned a malicious QR code, don't panic: in most cases the scan alone did nothing harmful. The real risk comes from what happened next. Close the page, then check whether you typed a password, entered card details, paid money, installed an app or granted permissions, and act on each of those right away.
First, work out what actually happened
A QR code is just a way of storing text, usually a web address. When your camera reads it, your phone normally shows you the link and waits for you to tap it. So the important question is not "Did I scan it?" but "What did I do after scanning?"
Think back and be honest with yourself. Did you:
- Only see the preview, then close it without opening anything?
- Open a web page but enter nothing?
- Type a username, password or one-time code into a login page?
- Enter card details, bank details or personal information such as your ID number or address?
- Pay money, for example through a payment QR or a fake parking or delivery page?
- Download and install an app or a "profile", or allow notifications?
Each answer leads to a different next step. If you only saw the preview, you are almost certainly fine. If you only opened a page and typed nothing, the risk is low, but it is still worth a few quick checks.
Step-by-step: what to do right now
Work through this list from the top. Skip any step that doesn't apply to you.
- Close the page and disconnect if something feels wrong. Close the browser tab. If a download started or the phone behaves strangely, switch on airplane mode while you check.
- Change any password you entered. Do it from the official app or by typing the real website address yourself, never from a link in the suspicious page. If you reuse that password anywhere else, change it there too.
- Turn on two-step verification. Add an authenticator app to the account you just secured, so a stolen password alone is no longer enough. Our two-factor authentication guide explains how.
- Call your bank if you shared financial details or paid. Use the number on the back of your card or in the official banking app. Ask them to block the card, watch for unusual transactions and tell you whether a payment can be disputed or recalled. Speed matters here.
- Remove anything you installed. Delete unknown apps, configuration profiles or browser extensions. On Android, check that no unknown app has accessibility or device-admin access. Revoke notification permissions you granted to strange websites in your browser settings.
- Sign out of other sessions. Many services, including email and social media, let you see active sessions and log out all other devices. Do this after changing the password.
- Update your phone and run a security check. Install pending system updates. On Android, run Google Play Protect; on any phone, review recently installed apps.
- Report it. Tell the bank, the service that was impersonated and, where appropriate, the police or your national cybercrime or consumer-protection reporting channel. If the QR code was on a physical sign or meter, tell the business or authority that owns it so they can remove it.
If you entered a password or one-time code
Phishing pages behind QR codes usually copy a familiar login screen, such as an email provider, a delivery company or a bank. Attackers often try the stolen details immediately, sometimes within minutes.
After changing the password, look through the account for signs of tampering:
- New forwarding rules or filters in your email
- Changed recovery phone number or recovery email
- Unknown devices or locations in the security or login history
- Messages sent from your account that you didn't write
If you typed a one-time code from SMS or an authenticator app into the fake page, assume the attacker may have used it to log in. Change the password, sign out all sessions and check the recovery settings straight away.
If you paid or shared card details
Contact your bank or e-wallet provider through official channels as soon as possible. Explain that you were tricked through a QR code, give the time and amount, and follow their instructions. Keep screenshots of the payment confirmation, the receiver name shown and the page you landed on.
Also watch your statements over the following weeks. Fraudsters sometimes test a card with a small charge before attempting a larger one. If you shared your ID number or address, be extra careful with calls, messages or emails that seem to "know" you, because that information can make later scams more convincing.
For payment QR codes specifically, read how to pay by QR code safely, which covers checking the receiver name before confirming.
If you installed an app or profile
Apps installed outside the official app stores, and configuration profiles on iPhone, can be used to spy on activity or steal data. Remove them first, then check:
- Settings for device management or profiles and delete anything you don't recognise
- Accessibility and device-admin permissions on Android, which malicious apps often request
- Browser notification permissions, which scam sites use to push fake warnings
If you cannot remove something, or the phone keeps showing pop-ups, back up your photos and important data and consider a factory reset. Then restore apps only from the official store.
How to avoid it next time
QR scams work because the code hides the destination. A few habits close that gap:
- Read the preview link before you tap. Check the domain carefully for misspellings or extra words.
- Be suspicious of QR codes stuck on top of other codes, especially on parking meters, posters and payment stands.
- Never log in or pay on a page you reached from a QR code you weren't expecting. Open the official app instead.
- Treat urgency as a warning sign. "Pay now to avoid a fine" or "your parcel will be returned" are classic pressure tactics.
If you are unsure about a code, you can scan a QR code online with QR-TH first. It reads the code in your browser and shows the destination before anything opens, so you can decide calmly. For more red flags, see our guide to QR code scams and quishing.
FAQ
Can scanning a QR code hack my phone by itself?
It is very unlikely. On an up-to-date phone, scanning usually only displays text or a link. The harm normally comes from opening a malicious page and then entering information, paying or installing something.
I opened the link but didn't type anything. Am I safe?
The risk is low. Close the page, clear that site's permissions if you allowed any, and keep your phone and browser updated. If anything downloaded, delete it without opening it.
Should I factory reset my phone?
Only if you installed something you cannot remove or the phone behaves abnormally after cleanup. For stolen passwords or card details, a reset doesn't help; changing passwords and contacting your bank does.
Who should I report a QR code scam to?
Report it to your bank if money is involved, to the company that was impersonated, and to your local police or official fraud-reporting service. If the code was on a public sign, tell the owner of that sign.
A suspicious scan is stressful, but quick action limits the damage in almost every case. Next time a code looks odd, check it before opening it: try QR-TH's free online scanner to see exactly where a QR code leads first.