Quick answer: Do not scan unsolicited payment, delivery, login, or prize codes; use the organization’s official app and preview the destination before opening.
A QR code hides its destination until scanned and a text message can be spoofed, so treat it like an unknown link. Start with the checks below and change one thing at a time. That preserves evidence and makes it easier to reverse a change that does not help.
Why this happens
The symptom usually comes from one of several layers: the device or app, its account settings, the local connection, or the service behind it. The most useful clues are when the problem began, whether it affects another device, and whether it follows one network or account.
- The code leads to a fake login or payment page.
- It encodes a wallet transfer, Wi-Fi profile, contact, or app download.
- The message creates urgency about a parcel, toll, fine, refund, or account.
- A shortened or look-alike domain hides the real destination.
Fix it in the safest order
- Ask whether you expected the message and verify the sender through a separate official channel.
- Use a camera that previews the full domain without opening it automatically.
- Check spelling, HTTPS domain, and path; HTTPS alone does not prove legitimacy.
- For banking, wallets, delivery, or government services, open the known official app instead.
- If you already entered information, secure the affected account and payment method immediately.
After each step, repeat the exact action that failed. Avoid changing several settings together; otherwise a temporary recovery can look like a permanent fix.
How to confirm the problem is fixed
The needed action should be visible in the independently opened official app or account, without relying on the QR code.
Common mistakes to avoid
- Do not install an APK or configuration profile from a QR code.
- Do not approve a wallet payment you did not initiate.
- Do not trust a logo printed beside the code.
FAQ
Can a QR code infect a phone just by being visible?
Simply viewing the image is generally not the issue; the risk begins when the encoded action is opened, a file is installed, or information is submitted.
Will these steps erase my data?
The diagnostic steps do not require a factory reset. Back up important files and recovery codes before reinstalling an app, clearing app storage, resetting a router, or changing an account recovery method.
Related PHWhy guides
Browse the Cybersecurity guides. You may also need Check whether a login page is fake or Respond to an unexpected reset code.
