If you've scanned a QR code and something feels wrong — a page that looked fake, a login prompt that seemed off, or you've just realized the code itself was suspicious — what you do in the next few minutes matters more than what already happened.
Step 1: Figure out what actually happened
Not every bad scan is equally serious. Find your situation below:
| What happened | Risk level | Do this now |
|---|---|---|
| Scanned the code, never opened the page | Low | No action needed — nothing was transmitted. |
| Opened the page, entered nothing | Low–Medium | Close the tab. Consider a quick device security scan if a file also downloaded. |
| Entered a password or login info | High | Go to Step 2 immediately. |
| Entered payment/card details | Urgent | Go to Step 3 immediately — contact your bank first. |
| A file downloaded or an app/profile install was prompted | High | Don't open it. Go to Step 4. |
| Shared a one-time passcode (MFA/2FA code) after scanning | Urgent | Treat as if your password was also compromised — go to Step 2, and check for unauthorized logins immediately. |
Step 2: If you entered a password
This matches what the FTC's own guidance recommends after a QR code scam involving stolen credentials:
Change the password immediately
Go directly to the real website (type the address yourself, don't use any link from the scam).
Change it everywhere else too
If you reuse that password anywhere else, change it there too — attackers routinely test stolen passwords across other accounts.
Turn on two-factor authentication
Enable it on the affected account if it isn't already.
Check recent activity
Look at the account's login history for anything unfamiliar.
Step 3: If you entered payment or card details
Contact your card issuer or bank right away
Most have a fraud line specifically for this and can freeze or replace the card quickly.
Review recent transactions
Flag anything unfamiliar immediately if found.
Set up transaction alerts
So any further unauthorized use is caught fast.
Card issuers and account providers are far more effective at stopping fraud when you report it quickly. There's no downside to acting immediately, even if it turns out to have been unnecessary.
Step 4: If a file downloaded or you were prompted to install something
Don't open it
Don't open the file or complete the install if you haven't already.
Run a security scan
If you already installed something, run a reputable antivirus/security scan on the device.
Contact IT if it's a work device
Rather than trying to handle it alone.
Step 5: Report it
Reporting doesn't undo the incident, but it helps flag the threat for others and, for financial fraud, is often a required step for dispute processes:
- In the U.S., you can report phishing scams to the FTC.
- If it was a parking meter or public sticker scam, report it to the property owner or local authority so the physical sticker can be removed.
- Report the domain to your browser or email provider if the phishing page is still active — most have a built-in "report phishing" option.
You didn't do anything unusually careless
Quishing is specifically designed to slip past normal caution. The most useful habit going forward is simple: check the destination before you visit it, especially before entering any password or payment information.
See the full checking guide →