I Scanned a QR Code and It Downloaded Something — What to Do Now

What QR codes can actually cause to download

A QR code is just a link. When your phone scans it, your browser opens the URL — and that page can trigger a download the same way any website can. What gets downloaded depends entirely on what the attacker (or the legitimate site) put there.

Common things QR code scans can push to your phone:

• PDF files. Often disguised as invoices, receipts, parking tickets, or delivery notices. Most PDFs are harmless to view, but malicious PDFs can exploit vulnerabilities in unpatched PDF readers to execute code.
• Android Package files (.apk). These are installable Android apps. Downloading an .apk does not install anything — but if you then tap “Install,” you could be installing spyware, adware, or a banking trojan. iOS blocks .apk files entirely; they're Android-only.
• Configuration profiles (.mobileconfig on iOS). Scammers use these to install a custom VPN or certificate that routes your traffic through their servers, letting them intercept your browsing. iOS requires explicit user approval to install a profile, but the prompt can be confusing.
• Calendar events (.ics). Low risk on their own — they add a calendar appointment. But the event description may contain spam links, and the invite can look like a legitimate notification.
• Contact cards (.vcf). Harmless unless the embedded phone number or email is designed to trick you into calling a scam number later.

The most dangerous downloads are .apk files on Android and .mobileconfig profiles on iOS. PDFs are worth being cautious about. Everything else carries lower immediate risk.

Do not open the file yet — check this first

Before you tap the downloaded file, take thirty seconds to assess it:

1. Find the file. On Android, open the Files app or your Downloads folder. On iPhone, check the Files app (Downloads) or your browser's download history.
2. Look at the file name and extension. A file called receipt.pdf or event.ics is what it says it is. A file called invoice.apk, update.exe, or anything ending in .apk that you didn't expect is a serious red flag — do not open it.
3. Check the file size. A blank one-page PDF used as a phishing lure is often suspiciously tiny (a few KB). A real invoice or menu PDF is usually at least 50–200 KB.
4. Consider context. Were you expecting to download something from that QR code? A restaurant menu QR code should open a web page, not push a PDF download to your phone. An unexpected download is always suspicious.

If anything looks off, delete the file immediately. Do not open it to “check what it is” — that is exactly the moment malicious code can execute.

What to do right now

If you haven't opened the file

1. Delete the file from your Downloads folder without opening it.
2. Clear your browser cache: Safari → Settings → Clear History and Website Data; Chrome → Settings → Privacy → Clear browsing data.
3. No further action is needed unless the QR code also took you to a page where you entered personal information.

If you opened a PDF or image

1. Update your PDF reader app and your phone's operating system immediately — patches close the exploits malicious PDFs target.
2. Delete the file.
3. Monitor your accounts for the next 24–48 hours for unusual activity.
4. If the PDF contained a link and you tapped it, treat that separately — apply the same steps as any phishing link.

If you downloaded and installed an .apk (Android)

1. Go to Settings → Apps and look for any app you don't recognize that was installed recently. Uninstall it.
2. Check app permissions: Settings → Apps → (app name) → Permissions. Revoke any that seem excessive.
3. Change passwords for your email and banking apps as a precaution — start with email since it's the master key to everything else.
4. Run a scan with Malwarebytes or Bitdefender for Android.
5. If your phone is behaving strangely after uninstalling (battery draining fast, data spiking, unfamiliar pop-ups), perform a factory reset after backing up your photos and contacts.

If you installed a configuration profile (iOS)

1. Go to Settings → General → VPN & Device Management.
2. If you see a profile you don't recognize, tap it and select Remove Profile.
3. Remove any VPN configuration that appeared around the time of the scan: Settings → General → VPN & Device Management → VPN.
4. Change your Wi-Fi and Apple ID passwords as a precaution.

How to prevent unexpected QR code downloads

The fundamental problem is that QR codes hide their destination — and their destination can trigger a download instantly. A few habits make a real difference:

• Use a scanner that previews the URL before opening it. QRsafer shows you the destination URL and runs a safety check before your browser loads anything. A page that auto-downloads a suspicious file will be flagged before you land on it.
• Keep your OS and apps updated. The exploits that malicious PDFs and .apk files rely on are routinely patched. An up-to-date device is dramatically less vulnerable.
• Never install an app via a QR code. If a QR code download is an .apk file, delete it. Real apps are distributed through the App Store or Google Play — never through a URL from a random code.
• Never install an iOS configuration profile you didn't request. If anything prompts you to install a profile after scanning, decline and close the page immediately.

Frequently asked questions