What to Do If a QR Code Asked for a One-Time Code

If you did not enter the code

1. Close the QR page and do not share the code with a person in chat or on the phone.
2. Open the account from the official app, bookmark, or typed domain.
3. Check recent sign-ins, password reset requests, payments, and device approvals.
4. Report the QR code to the business, school, venue, or support team that appears to be copied.

If the page looked like account recovery, compare What to Do If a QR Code Opened a Password Reset Page.

If you entered the one-time code

• Login code: review sessions and sign out unknown devices.
• Password reset code: change the password from the real service and check recovery methods.
• Payment code: contact the bank, card issuer, or payment app tied to the transaction.
• Backup code: generate new backup codes from the official account settings if supported.

For two-factor bypass patterns, read Can a QR Code Bypass Two-Factor Authentication? and I Scanned a QR Code and It Sent Me to a Fake Login Page.

One-time-code red flags

• The QR code appeared on an unexpected sign, flyer, email, invoice, or support page.
• A caller or chat agent asks you to read the code aloud.
• The code message says not to share it, but the page tells you to enter it anyway.
• The domain does not match the company, bank, school, or account provider.

If the QR page tried to add an authenticator or device, see What to Do If a QR Code Opened an Authenticator Enrollment Page.

Frequently asked questions