What to Do If a QR Code Opened an Email Draft

If the draft opened but you did not send it

1. Close or discard the draft.
2. Check the recipient address before replying or sending anything.
3. Do not attach IDs, receipts, bills, tickets, or screenshots unless you verify the recipient.
4. Use the official website, app, or known support address if the QR code came from a sign, flyer, receipt, or unexpected message.

For email-specific recovery, see What to Do If You Scanned a QR Code in an Email and QR Code Phishing in Your Inbox.

If you already sent the message

• Save the sent message, QR code photo, and destination details.
• Contact the real organization through a known channel and ask whether the address is theirs.
• Change passwords if you sent login details, one-time codes, or account recovery information.
• Watch payments, orders, appointments, or accounts if the email included card, medical, travel, or identity details.

If messages were sent without your action, use I Scanned a QR Code and Emails Were Sent from My Account.

Email draft red flags

• The recipient uses a personal mailbox instead of an official domain.
• The body includes account numbers, passwords, one-time codes, or payment details.
• The draft asks you to approve a refund, donation, order, appointment, or job step by email.
• The QR code appeared as a sticker or unexpected attachment in a message.

Frequently asked questions