What to do if you scanned a scam QR code
A QR code only sends you to a page. The risk is what you did on that page - entering details or paying.
Quick answer
A QR code only sends you to a page. The risk is what you did on that page - entering details or paying.
- Close the page and do not enter details
- If you paid, contact your bank immediately
- Clear the page from your browser
- Note the website address without reopening it
Do this now
Contact your bank if you paid or entered card details.
Understanding what happened
A QR code is just a link you can't read in advance, so scanning a scam code lands you on a page chosen by the scammer - usually a fake login or a payment request. Scanning by itself rarely causes harm; the risk comes from what you do next on the page it opens.
Common QR scams include 'scan to receive a refund' (you never need to scan to receive money), parking and toll codes that lead to fake payment forms, and codes in emails that open lookalike sign-in pages to capture your password.
If you only scanned and then closed the page, you're likely fine - but it's worth checking the accounts the page imitated. If you entered details or approved a payment, the steps below match what to do to each situation, from securing a login to contacting your bank.
First 5 minutes
- Close the page and do not enter details
- If you paid, contact your bank immediately
- Clear the page from your browser
- Note the website address without reopening it
First 24 hours
- Change any password you entered
- Watch for unauthorised charges
- Report the location of physical fake QR codes if relevant
- Report to your fraud authority
What not to do
- Do not pay anyone who promises to recover your money for an upfront fee
- Do not act on follow-up messages claiming to be the fraud team
- Do not delete evidence before saving it
Evidence to save
- Screenshots of the message and sender details
- Phone numbers, usernames, links, and account or wallet addresses
- Transaction references, receipts, and amounts
How to report
Report through official channels for your area.
Find official reporting links for your country in the reporting directory.
- Do not use phone numbers or links from the suspicious message - look up the official ones yourself.
- Report quickly if money was sent or ID documents were shared; speed improves your options.
- Keep your evidence - see how to save scam evidence.
Beware of recovery scams: no legitimate service guarantees getting your money back for an upfront fee.
This is general safety information, not legal, financial, or cybersecurity incident-response advice.
Frequently asked questions
How quickly should I act?
As soon as possible. Fast action - especially contacting your bank - gives the best chance of limiting harm or stopping a payment.
Will I get my money back?
Sometimes, if you act quickly, but there is no guarantee. Be very cautious of anyone who promises guaranteed recovery for an upfront fee - that is a recovery scam.