I Scanned a QR Code and It Sent a Text from My Phone — What Just Happened?

What actually happened: sms: QR codes

QR codes can encode more than website addresses. A QR code containing an sms: URI — for example, sms:+19005551234?body=YES — tells your phone to open the native Messages app with a phone number and a pre-written message ready to send. The same mechanism is used legitimately by businesses for opt-in text notifications: you scan a code, your Messages app opens with a pre-filled text, and you tap Send to subscribe.

Scammers abuse this feature to trick people into sending a text that signs them up for a paid SMS subscription, opts them into a marketing list, or votes in a premium-rate poll — all without the sender understanding what they agreed to. In most cases you still have to tap Send yourself, but the experience can feel so automatic that many people don't realize they did it.

The important thing to know: a QR code cannot send a text completely on its own. Your phone's operating system requires an explicit user action. If texts are leaving your phone without you opening anything, that is a sign of a malicious app — a separate issue unrelated to the QR code scan.

Scenario 1: Your SMS app opened but you didn't send anything

If your Messages app opened with a pre-filled number and message and you closed it without tapping Send, your risk is very low. No text was sent, no subscription was triggered, and no charges were incurred. Close the app and move on.

You may want to note the pre-filled phone number, especially if it looks like a short code (4–6 digits) or an international number, in case you see unexpected charges on a future phone bill.

Scenario 2: A text was sent — what's the real risk?

If you find an outgoing text in your Sent folder that you didn't intentionally write, the risk depends on where it was sent:

• Premium-rate short codes. Short codes in the US (5–6 digit numbers) can be used for legitimate services like weather alerts or parking payments, but they can also be premium-rate numbers that charge $5–$20 per message or initiate a recurring weekly subscription billed through your carrier. These charges appear on your phone bill, not your credit card.
• International numbers. Some scam sms: links target international short codes or long numbers in countries with high per-message carrier rates. The charge appears as a standard international SMS on your bill.
• Marketing opt-in lists. Even if the text was free to send, you may have opted into a marketing or spam list that will now send you a high volume of SMS messages. Your phone number is now confirmed as active and may be sold to other lists.
• Standard phone numbers. If the text was sent to a regular 10-digit US number, the risk is generally low — you sent a single message that likely went to a scammer-controlled inbox for tracking opt-ins. No financial harm, but your number is now on a spam list.

How to check if a text was sent

1. Open your phone's Messages app and go to your Sent or All Messages view.
2. Sort by most recent and look for any outgoing message in the last few minutes sent to a number you don't recognize.
3. Note the destination number exactly. If it is 4–6 digits, it is a short code. If it starts with a plus sign and a country code, it is an international number.
4. Search the number in a free reverse-phone lookup (800notes.com, WhoCalledMe.com) or the FTC's consumer complaint database to see if it is associated with known scams.

What to do right now

1. Block the destination number. On iPhone, open the text thread, tap the number at the top, and select Block this Caller. On Android, long-press the thread and select Block. This prevents follow-up texts from the same number.
2. Contact your carrier's fraud line. If the text was sent to a short code or international number, call your carrier (AT&T, Verizon, T-Mobile, or your carrier's fraud line) and report potential unauthorized premium SMS. Ask them to review your account for pending charges and to block future premium-rate text billing. Most carriers will reverse a first-time fraudulent charge if you report it before the billing cycle closes.
3. Monitor your phone bill. Check your carrier account online over the next 1–2 billing cycles for unexpected SMS-related charges, especially line items labeled “premium text,” “short code,” or third-party service charges.
4. Forward spam texts to 7726 (SPAM). In the US, forwarding the message to 7726 reports it to your carrier's spam-detection system, which helps protect other customers.
5. Report to the FTC. File a report at ReportFraud.ftc.gov. Include the destination number, the location where you scanned the QR code, and any charges you incurred.
6. If texts keep sending on their own, the cause is likely a malicious app, not the QR code. Check Settings → Apps (Android) or Settings → Privacy (iOS) for apps with unusual SMS permissions, and run a reputable malware scan.

What a QR code cannot do through SMS

It is worth being clear about what an sms: QR code is and is not capable of:

• It cannot read your existing text messages or contact list.
• It cannot send a text without your phone's messaging app opening first on modern iOS or Android.
• It cannot access your identity, passwords, or financial accounts through an SMS action alone.
• It can open your SMS app with a pre-filled number and message, and if you tap Send — intentionally or accidentally — it can trigger a subscription or a charge.

The damage from an sms: scam is usually financial (a premium-rate charge) or annoyance (spam list enrollment) rather than identity theft. Act quickly to reverse any charges and you should be fine.

Frequently asked questions