I scanned a QR code and entered my details, was it a scam?
Last reviewed: 2026-08-01 · Checked with Hunch’s on-device engine, the same one inside the extension. How Hunch checks →
Part of our guide: What to do if you got scammed →
If scanning that code sent you to a page that asked you to "verify your identity" or pay to fix something, you likely hit a quishing scam, and you can still contain it. Criminals stick fake QR stickers over real ones or text them to you, so the code lands on a lookalike site instead of the real business. What you do next depends on whether you entered card details, a password, or personal information, so work through the recovery steps below.
Got a message like this? Paste it here →
Quishing targets busy people mid-task, diners settling a bill, drivers powering up an EV, who scan without pausing to read the address. It works because a QR hides its destination until it is too late, a physical sticker in a trusted place feels legitimate, and "finish your payment" framing makes handing over card details seem like the normal next step.
Illustrative example of the pattern, not a real message someone received.
How to verify it yourself
- Ask what the code actually did: a safe QR opens a page you can read; a scam one rushes you to "verify" or pay under a deadline before you check the address.
- Read the full domain the code opened, a host like menu-order-verify.example is not the restaurant's or business's real site, and that mismatch is the tell.
- Restaurant tables: a fake sticker placed over the real menu code sends your "table payment" to a scammer instead of the venue, pay staff directly if unsure.
- EV chargers: a counterfeit QR pasted on the charging post routes your card to a clone "activation" page, start charging only from the operator's own app or the numbers printed on the unit.
Common questions
can a QR code steal my information
A QR code itself is just a link, but scammers use it to send you to a fake page that harvests your card, password, or personal details. The danger is the site it opens, not the square.
I scanned a QR at a restaurant and paid a scammer
Contact your bank right away to dispute the charge and freeze the card, then tell the restaurant so they can remove the fake sticker. Pay in person or through the venue's own app next time.
is the EV charger QR code payment safe
Only if the code is the charging network's official one. Scammers cover real charger QR codes with fakes, use the operator's app or the ID printed on the unit instead of a loose sticker.
what do I do after scanning a scam QR code
Stop entering anything, close the page, and if you already submitted card or login details, freeze the card and change the password. Then report it and watch your statements.
If you already responded
- If you entered card or bank details, call your bank's real number now, freeze the card, and dispute any charge that appears.
- If you entered a password, change it on that account and everywhere you reused it, then turn on two-factor authentication.
- Revoke access for any unfamiliar device or app that appears in your account's security settings after the scan.
- Report the scam at reportfraud.ftc.gov, and if personal ID was exposed, add a report at IdentityTheft.gov; tell the venue so they pull the fake sticker.
- Be wary of any later message promising to "reverse the charge" for a fee, that follow-up is a second scam.
If you were already hit, expect a follow-up
One more thing to expect: after a scam, your details often land on lists that get reused, so you may be contacted again, sometimes by people posing as investigators, your bank's "fraud team," or "recovery agents" who promise to get your money back for an upfront fee. That follow-up is a second scam. No legitimate service charges a fee to recover funds.
Source: FTC, Report Fraud