# I scanned a QR code. Now what? > Scanned a suspicious QR code? What matters next depends on what happened after the scan. A calm step-by-step guide to quishing and QR-based phishing. Canonical: https://www.phishclean.com/blog/i-scanned-a-qr-code-now-what Last updated: 2026-08-13 March 15, 2026 By [PhishClean Research Team](https://www.phishclean.com/about) - browser security guidance based on phishing analysis, defensive research, and product work. Scanning the QR code itself is not always the dangerous step. What matters is what happened after the scan. Did it open a page? Ask you to log in? Ask for payment? Start a download? QR-code phishing works because the code hides the destination until you are already halfway into the flow. If the QR code led you to a login page, payment request, or fake support warning, stop using that page and verify the service through a known website or app instead. ## Why QR-code scams feel harder to judge With a normal link, you can often hover, preview, or at least read part of the destination. A QR code removes that preview. You point the camera, trust the context, and only afterward discover where it goes. That is why quishing attacks show up on parking meters, flyers, restaurant tables, invoices, package messages, and building notices. ### The destination is hidden You usually see the brand, poster, or sticker first, not the actual URL. ### The flow stays on your phone That makes it easier for attackers to hide domains and push faster decisions. ### Context does the trust work People trust the location of the code even when they never verify the page it opens. ## What to do depends on what happened next ## If you only scanned it and saw the page If you opened the page but did not log in, pay, download, or approve anything, close it and move on. You should still avoid revisiting it, but the risk is lower than people often fear. ## If you entered a password Go to the real service through your own bookmark or app and change the password immediately. If you reused that password anywhere else, change those too. Then check recent account activity. ## If you entered card or banking details Contact your bank or card issuer right away. Tell them you may have submitted payment details to a fraudulent page. Fast reporting matters more than perfect certainty. ## If the QR code started a download or app install Delete anything you did not intend to install, review app permissions, and run a security scan if needed. If it was on a work phone, tell IT instead of waiting for signs of trouble. - Prefer typing or searching for the official site yourself when the QR code is asking for login or payment. - Be extra suspicious of stickers placed over other signs, especially on parking meters or public kiosks. - If your phone shows a URL preview before opening, actually read it. - Treat QR codes in email attachments or printed invoices with the same caution you would use for a link. - [Why phishing can feel safer on a phoneWhy mobile context helps attackers hide clues.](https://www.phishclean.com/blog/why-a-phishing-site-can-look-safe-on-desktop-but-not-phone) - [How QR code phishing worksThe tricks behind quishing and how to spot them.](https://www.phishclean.com/threats/qr-code-phishing-attacks) - [What to do after a phishing attackStep-by-step damage control if data was entered.](https://www.phishclean.com/blog/what-to-do-after-phishing-attack) - [How to check if a website is safeA useful checklist after any suspicious redirect.](https://www.phishclean.com/blog/how-to-check-if-website-is-safe) - [Phishing attacks explainedHow attackers turn trust and urgency into clicks.](https://www.phishclean.com/threats/phishing-attacks) ## Frequently asked questions Can a QR code infect my phone just by scanning? Usually the danger comes from what opens afterward, not from the scan alone. The risky steps are often logging in, paying, downloading, or approving permissions. Why are QR scams becoming more common? They work well on phones, hide the destination, and fit naturally into real-world contexts like signs, invoices, and messages. Should I report a malicious QR code? Yes. If it was in a public place, tell the business or property owner. If it led to a phishing page, report the site as well. ## Get extra help checking the page behind the code PhishClean helps spot suspicious page behavior locally in your browser, which is especially useful when a QR code pushes you into a rushed mobile flow. [Install PhishClean free](https://www.phishclean.com/#install) Last updated: 13 August 2026 ## Share this guide If this helped, share it with someone who would benefit from it, or subscribe for new browser-security guides from PhishClean. Share on X Share on LinkedIn Get practical phishing and browser-safety articles in your inbox. No salesy drip, just new guides and product updates when they are worth sending.