QR code login scams: scanning someone else's code

Why a QR login skips your password and 2-step check

QR sign-in is designed for convenience. Your phone is already signed in and trusted, so scanning a code shown on a computer tells the service: let this other screen in, I vouch for it. No password is typed and no extra code is needed, because your phone is the proof.

That is exactly what the scammer wants. Discord's account security guidance says that scanning such a code will allow the attacker to log into your account directly, bypassing your password and any 2FA. Strong passwords and 2-step verification are still important, but they cannot stop a login you approve yourself.

The login approval screen on your phone is your last chance to stop it. Many apps show where the sign-in request is coming from, such as a browser type or rough location. Read it carefully. If you did not just open a login page on a computer in front of you, cancel.

Some people assume scanning is harmless because nothing is typed. That is the point of the scam: it feels like a lighter action than entering a password, so people are less cautious. Treat approving a QR login as exactly equivalent to giving someone your password and your 2-step code at the same time.

The only safe way to use a login QR code

Discord's advice is to only scan QR codes you generated yourself. In practice:

• You are sitting at the computer you want to sign in to.
• You opened the login page yourself by typing the address or using the installed app.
• The code is on that screen, in front of you, not in a message, image or video.

If any one of those is not true, do not scan. And if a sign-in approval appears on your phone when you were not trying to log in anywhere, always cancel it.

'Verify to join' servers and fake bots

Community servers often use legitimate verification bots to keep out spam, for example by asking you to click a button or answer a question. Scam servers copy the look of these bots but ask you to scan a QR code with your app's scanner. No real verification step needs your account to sign in somewhere else.

These servers are frequently advertised through fake giveaways and free subscription offers. If a server's first step is a QR code, leave and report it.

When in doubt, ask a server moderator in a public channel whether verification really needs a QR code. Legitimate servers will say no.

Printed and on-screen QR codes outside games

QR codes are also used in wider scams: stickers placed over real codes on car park machines, codes in emails that lead to fake login pages, and codes on social media. The NCSC's scam text guidance mentions that screenshots of scam QR codes can be sent to its reporting service.

The same rule helps everywhere: before acting on a QR code, check where it came from, and check the web address it opens before signing in to anything.

Before you scan any QR code in public, look closely at it. A sticker placed over the original, a code that looks out of place or one that appears in an unexpected email are all reasons to find another way to reach the service.

Teaching the QR rule at home

For children, a short rule works best: 'Only scan login codes that you made yourself, on your own screen.' Practise once together by signing in to a family computer with the app's QR feature, so they know what a real login looks like and can spot a fake request.

Turning on approval prompts and checking active sessions regularly is covered in our parents' guide. If an account has been taken, start at hacked: start here.

Checking your active sessions after a scan

Even if you are not sure whether you approved a QR login, it is worth checking your account's list of signed-in devices or sessions. Most platforms show this in their security or devices settings, often with a rough location, device type and time.

Look for:

• a browser or computer you do not own;
• a sign-in time that matches when you scanned the code;
• a location that does not fit where you or your household have been.

Remove anything unfamiliar and change your password, which on Discord also logs out every device. Then check the account's email address, phone number and 2-step verification settings, because an attacker who got in may have changed them to lock you out later.

If the account has already been taken over and you cannot sign in, go to our hacked account triage and start the official recovery route for your platform. Afterwards, consider limiting who can message you, since login QR codes usually arrive through direct messages from strangers or newly joined servers.