What is happening here
A fake survey QR code promises a reward, discount, or prize draw in exchange for a few questions. The survey itself is the harvest: each answer adds personal detail that can be used for further scams or account attacks.
These codes appear on receipts, flyers, social posts, and in messages. The reward is the bait, and the survey questions grow more personal as you go.
Red flags to check before you scan
- The reward sounds generous for a short survey, such as a large gift card for a few taps.
- The survey asks for personal details a feedback form would not need: full date of birth, address, account numbers, or passwords.
- The survey is hosted on an unfamiliar domain rather than the brand official site.
- The code appears on a flyer or message with no verifiable link to the brand it names.
- The survey pushes you toward a payment, shipping fee, or sign-in to claim the reward.
Verify before you trust it
1. Check whether the brand is actually running the survey by visiting its official site or social account.
2. Read the questions before answering, and stop if they move from feedback to personal data.
3. Never enter passwords, card details, or one-time codes to claim a survey reward.
4. Treat any survey that demands payment to release a prize as a scam.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR typosquat checker](/qr-typosquat-checker) before you trust a code you did not expect.
- Inspect the code with the [QR tamper evidence planner](/qr-tamper-evidence-planner) before you trust a code you did not expect.
- Check the address with the [QR consent note builder](/qr-consent-note-builder) before you trust a code you did not expect.
- Practise spotting patterns with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
- Review the chain with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
- Keep a record with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Plan protection with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
