diff --git a/matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/session/contentscanner/ScanEncryptorUtils.kt b/matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/session/contentscanner/ScanEncryptorUtils.kt
index f02a11628a..ea30a97a72 100644
--- a/matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/session/contentscanner/ScanEncryptorUtils.kt
+++ b/matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/session/contentscanner/ScanEncryptorUtils.kt
@@ -26,6 +26,7 @@ import org.matrix.rustcomponents.sdk.crypto.PkEncryption
 
 internal object ScanEncryptorUtils {
 
+    @Throws
     fun getDownloadBodyAndEncryptIfNeeded(publicServerKey: String?, mxcUrl: String, elementToDecrypt: ElementToDecrypt): DownloadBody {
         // TODO, upstream refactoring changed the object model here...
         // it's bad we have to recreate and use hardcoded values
@@ -43,6 +44,7 @@ internal object ScanEncryptorUtils {
                 v = "v2"
         )
         return if (publicServerKey != null) {
+            // Note: fromBase64 can throw Exception
             val pkEncryption = PkEncryption.fromBase64(key = publicServerKey)
             val pkMessage = pkEncryption.encrypt(DownloadBody(encryptedInfo).toCanonicalJson())
             DownloadBody(
diff --git a/matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/session/contentscanner/tasks/ScanEncryptedTask.kt b/matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/session/contentscanner/tasks/ScanEncryptedTask.kt
index e098607eb6..b3f4645abc 100644
--- a/matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/session/contentscanner/tasks/ScanEncryptedTask.kt
+++ b/matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/session/contentscanner/tasks/ScanEncryptedTask.kt
@@ -42,12 +42,12 @@ internal class DefaultScanEncryptedTask @Inject constructor(
 
     override suspend fun execute(params: ScanEncryptedTask.Params): ScanResponse {
         val mxcUrl = params.mxcUrl
-        val dlBody = ScanEncryptorUtils.getDownloadBodyAndEncryptIfNeeded(params.publicServerKey, params.mxcUrl, params.encryptedInfo)
 
         val scannerUrl = contentScannerStore.getScannerUrl()
         contentScannerStore.updateStateForContent(params.mxcUrl, ScanState.IN_PROGRESS, scannerUrl)
 
         try {
+            val dlBody = ScanEncryptorUtils.getDownloadBodyAndEncryptIfNeeded(params.publicServerKey, params.mxcUrl, params.encryptedInfo)
             val api = contentScannerApiProvider.contentScannerApi ?: throw IllegalArgumentException()
             val executeRequest = executeRequest<ScanResponse>(null) {
                 api.scanFile(dlBody)