Act immediately — do not wait.
Wire transfers can be recalled within hours. Every minute you wait reduces your chance of recovering the money.
I Scanned a QR Code and My Bank Account Was Drained — What to Do Right Now
Your bank account was emptied after scanning a QR code. Here is the exact order of steps to take — starting with one phone call you need to make before you read anything else.
Step-by-step: what to do right now
Call your bank's fraud line right now.
Use the number on the back of your debit or credit card, or the number on your bank's official website — never a number from the scam message. Ask them to freeze your account, stop any pending transfers, and open a fraud claim. This is the most important step.
Ask specifically about wire recall.
If money was sent by wire transfer, tell the fraud team immediately and ask them to attempt a wire recall. Domestic wires can sometimes be retrieved if the receiving bank hasn't released the funds yet. The window is measured in hours, not days.
Freeze your account and lock your cards.
If your bank offers an in-app freeze or card lock, use it while you're on hold with them. This stops additional unauthorized transactions while you work through the next steps.
Change your online banking password immediately.
Do this from a separate device on a network you trust — not the same phone or Wi-Fi you used when you scanned the code. End all active sessions from your bank's security settings.
File a report with the FTC at ReportFraud.ftc.gov.
The FTC creates a report that helps banks, law enforcement, and consumer protection agencies track the fraud. This also generates a record you can use for disputes.
File a complaint at IC3.gov.
The FBI's Internet Crime Complaint Center (IC3) tracks financial cybercrime. Filing here is important if money was transferred — the IC3's Financial Fraud Kill Chain (FFKC) has helped recover funds in time-sensitive cases.
File a local police report.
Your bank may require a police report number to process a fraud claim. Even if local police cannot recover the money, a report creates a record for insurance, employer fraud protections, and further disputes.
How a QR code drained your bank account
Most bank-account-draining QR scams work through one of two paths:
Fake login page (most common). The QR code opened a page that looked exactly like your bank's online banking portal — same logo, same layout, often a domain close enough to miss at a glance. When you entered your username, password, and possibly a one-time passcode, those credentials went to the attacker, who immediately logged into your real account and initiated transfers.
Fake payment portal. Some QR codes lead directly to payment pages — fake Zelle, Venmo, or wire-transfer flows — disguised as a legitimate service. You entered payment details believing you were doing something routine, but the transaction went to an attacker-controlled account.
This attack technique — called quishing — is growing because QR codes force everything onto your phone's browser, where the address bar is easy to overlook, and because QR codes bypass the URL-scanning filters in email security software.
Your legal protections — what you can recover
Federal law limits your liability for unauthorized transactions, but the protections vary by payment type:
- Debit card / ACH transactions (Regulation E): If you report within 2 business days of learning about the fraud, your liability is capped at $50. If you report between 2 and 60 days, it rises to $500. After 60 days you may lose everything. Report immediately.
- Credit card transactions (Regulation Z): Your liability is capped at $50 regardless of when you report. Credit card fraud is easier to dispute than debit.
- Zelle and peer-to-peer transfers: These are harder to recover because they are authorized — you or someone with your credentials initiated them. Banks are under increasing regulatory pressure to cover Zelle fraud, but it is not guaranteed. Report to your bank and file with the CFPB at consumerfinance.gov/complaint to document the dispute.
- Wire transfers: Domestic wires can sometimes be recalled if you contact your bank within hours. International wires are substantially harder to recover. Speed is everything.
For more on the bank dispute process, see our guide on bank QR code scams and how banks investigate fraud claims.
If you also entered personal information
Some QR phishing pages collect more than banking credentials — they ask for your Social Security number, date of birth, or driver's license number under the guise of identity verification. If you entered any of those details, take these additional steps:
- Place a credit freeze at all three bureaus — Equifax, Experian, and TransUnion. It is free, instant online, and reversible.
- File an identity theft report at IdentityTheft.gov, which generates a personal recovery plan.
- Contact the IRS Identity Protection Specialized Unit at 1-800-908-4490 if your Social Security number was entered.
For a full guide on this scenario, see I scanned a QR code and it asked for my Social Security number.
Frequently asked questions
Can I get my money back after a QR code scam drained my bank account?
Possibly, but speed determines your options. Debit card fraud carries liability caps under Regulation E — $50 if you report within 2 business days, $500 within 60 days. Credit card fraud is capped at $50 under Regulation Z. Wire transfers require an immediate recall request to your bank. Report to your bank now, then file with the FTC and IC3.
How did a QR code drain my bank account?
The QR code led to a fake bank login page designed to look identical to your bank's real site. Entering your credentials gave the attacker access to your account — they then initiated transfers, Zelle payments, or wires before you noticed. This attack is called quishing, and it works because the fake page looks real and your phone's browser makes URLs easy to miss.
Should I file a police report after my bank account was drained?
Yes. File with local police and at IC3.gov. Your bank may require a police report number to process your fraud claim. An IC3 report also routes your case to the FBI's Financial Fraud Kill Chain, which has successfully recalled funds in some wire fraud cases.
What if a wire transfer was sent — is it too late?
Not necessarily — but the window is extremely short. Call your bank's fraud line immediately and ask for a wire recall. Domestic wires can sometimes be retrieved if the receiving bank hasn't released funds yet. International wires are harder. Do not wait — every hour reduces your chances.
Prevent this from happening again
QRsafer checks every QR code's destination URL against threat intelligence before your browser opens it — stopping fake bank login pages before they load. Free on iOS and Android.