First, do not panic
Quishing is phishing delivered through a QR code. Instead of a clickable link that email filters can inspect, the attacker hides the destination inside a QR image, and the victim supplies the missing step by scanning it with a phone.
If you already scanned, the next few minutes matter more than the scan itself. What you do now can limit the damage, and most of the steps below take only a few minutes each.
Contain it right now
1. Close the page at once if it asks for a password, payment, or code you did not expect to give.
2. Do not enter credentials, card details, or one-time codes on a page reached from an unexpected QR code.
3. If you typed a password, change it from a clean browser session and turn on two-factor authentication.
4. If you entered card details, contact your card issuer and ask them to watch the card or replace it.
What to check next
- Check the accounts the page asked about for unfamiliar sign-ins, messages, or changes.
- Review recent sent messages and app permissions in case anything was approved during the scan.
- Keep the suspicious message or photo of the code so you can report it accurately.
- Tell the impersonated organisation through its official reporting channel so it can warn others.
Reporting helps the next person
Reporting is not just paperwork. It helps the impersonated organisation warn other customers, helps platforms remove the fake page, and helps investigators connect one scam to others. Report promptly, and include the time, the place or message, and what you entered. You do not need to feel embarrassed about reporting. These scams are built to fool busy people, and a fast report protects everyone who comes after you.
Putting this into practice
Work through the steps in order: contain, check, then report. Start with the highest-risk exposure first. If money is involved, the bank comes before everything else. If credentials are involved, change the password from a clean session and review active sessions and linked devices. Write down what happened while it is fresh, including the page address, the payee name, and the time, because those details make reports and disputes easier.
Common mistakes to avoid
One mistake is trying to fix things by scanning the code again or following more links from the fake page. Another is assuming nothing happened because nothing looks wrong yet. A third is delaying the report out of embarrassment, which gives the attacker more time to use what was taken. Act on the exposure you had, not on whether you can see damage yet.
Quick checklist
- Close the fake page and do not follow further links from it.
- Change any exposed password from a clean session.
- Review active sessions, linked devices, and recent activity.
- Contact your bank at once if money or card details were involved.
- Report the code to the impersonated organisation and the platform.
- Keep a written record of what happened and when.
Related tools and guides
- Run the destination through the [QR print proof checklist](/qr-print-proof-checklist) before you trust a code you did not expect.
- Inspect the code with the [QR redirect chain viewer](/qr-redirect-chain-viewer) before you trust a code you did not expect.
- Check the address with the [QR scan log](/qr-scan-log) before you trust a code you did not expect.
- Practise spotting patterns with the [QR typosquat checker](/qr-typosquat-checker) before you trust a code you did not expect.
- Review the chain with the [printed QR tester](/printed-qr-tester) before you trust a code you did not expect.
- Keep a record with the [UTM builder](/utm-builder) before you trust a code you did not expect.
- Plan protection with the [blog](/blog) before you trust a code you did not expect.
- Run the destination through the [QR scanner](/qr-scanner) before you trust a code you did not expect.
