What to do next.

Something has just happened and you are not sure what to do. Choose the situation below. Each one starts with the first thing to do, and every step helps even if you are not sure it was a trick.

The short answer. Stop, close or hang up, and contact the organisation yourself using a number or website address you already trust. Do not scan, call back, pay, read out a code or paste anything because a message, caller or page asked you to.

Last reviewed 8 October 2026. UtilForge’s tools run on your own phone or computer and send nothing anywhere, so you can use them while you decide.

I scanned a QR code

First: close the page that opened and type nothing into it.

• If you entered card or bank details, phone your bank straight away on the number printed on the back of your card, and tell them what you entered.
• If you typed a password, change it from a different phone or computer, and change it anywhere else you use it.
• If an app or file was installed, remove it and run a full scan with your security software.
• A QR code stuck on a parking meter, a poster or a letter can sit on top of the real one. Look at the web address your phone shows before you open it, and if it does not match the organisation, do not open it. You can type the organisation’s own address instead.

To check a payment page that opened, use Before You Pay.

Someone phoned and asked for money, a code or access

First: end the call. You do not owe the caller an answer.

• Phone the organisation back on a number you already trust: the one on your card, on a bill or on its official website. If you can, use a different phone, or wait a few minutes first, because a scammer can keep a line open.
• Official guidance in the United Kingdom and the United States is that banks, the police and government agencies do not ask you to move money to a “safe account”, to read out a code sent to your phone, or to install an app so they can see your screen.
• If you shared a code or card details, phone your bank at once. If you let someone control your computer, switch off its internet connection, then change your passwords from a different device and ask someone qualified to check it.
• Agree a family safe word so a voice that sounds like a relative can be checked.

Related: a relative phones asking for money and how to report a suspicious text or call.

A page said “verify you are human” and told me to paste something

First: close the page. A real check only needs a tick, a tap on pictures or a short puzzle inside the page. It never needs the Windows key and R, Control and V, Run, PowerShell or Terminal. This trick is sometimes called ClickFix, a name security researchers use.

• Use Before You Paste a Command to read the command or the page’s instructions and see the warning signs.
• If you already pasted and ran it, disconnect the device from the internet, change your passwords from a different device, tell your bank if you use banking on it, and tell your information technology team if it is a work device.

I tapped a link in a message

First: close the page and type nothing more into it. The steps depend on what happened next, and they are in I clicked a link in a text: what to do now.

Forward the message to 7726, the number for reporting spam texts in the United Kingdom and the United States, so the phone company can block the sender.

Where to report

If money has left your account, tell your bank first, then report it. Where to report, country by country lists the official place for each country.

Questions people ask

Is it my fault?

No. These tricks are built to look real. Acting quickly is what helps.

Does UtilForge see what I type on these pages?

No. The pages are set so that your browser stops them sending anything off your phone or computer.

UtilForge is not a bank, a security company or a legal adviser, and this page is general guidance. Your bank can tell you what else to do for your situation.