What is happening here
A fake customer support QR code leads to a chat, call, or form run by scammers posing as a brand support team. Once contact is made, they ask for account details, remote access, or payment to fix a problem that does not exist.
These codes appear on fake support pages, in search results, on flyers, and in messages claiming an issue with your account, order, or device. They exploit the trust people place in support teams.
Red flags to check before you scan
- The support contact came from a flyer, message, or search result rather than the brand official site or app.
- The agent asks for your password, one-time code, or full card details to verify you.
- The agent asks you to install remote-access software or to share your screen.
- The agent claims an urgent problem and demands immediate payment to fix it.
- The QR code points to a chat or form on a domain that does not belong to the brand.
Verify before you trust it
1. Find support through the brand official site or app, not through the code you were given.
2. Check the domain of any support page before you share details.
3. Treat any request for a password, one-time code, or remote access as a reason to stop.
4. Ask for a ticket number and verify it through the official channel.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR scan log](/qr-scan-log) before you trust a code you did not expect.
- Inspect the code with the [QR typosquat checker](/qr-typosquat-checker) before you trust a code you did not expect.
- Check the address with the [QR tamper evidence planner](/qr-tamper-evidence-planner) before you trust a code you did not expect.
- Practise spotting patterns with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Review the chain with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
- Keep a record with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
- Plan protection with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
