What is happening here
Session hijacking through a QR code happens when a code tricks you into approving a sign-in or linking a device that hands control of your account to someone else. The page may look like a normal login or device-pairing screen.
This pattern appears in fake login pages, fake device-linking flows, and messages that ask you to scan to approve access. The danger is not the scan itself but the approval you are asked to give afterwards.
Red flags to check before you scan
- The code asks you to sign in or approve a session you did not start.
- The page asks for a code, password, or approval while you are already signed in elsewhere.
- The request arrives unexpectedly, with no action of yours that would need approval.
- The page shows vague details about the device, location, or app requesting access.
- The message pressures you to approve now or lose access.
Verify before you trust it
1. Stop and check your account for pending sign-in requests in the official app or security settings.
2. Confirm whether you started a sign-in or pairing flow before you approve anything.
3. Read the device and session details shown in your account, not only on the page the code opened.
4. Decline any approval you did not initiate, and sign in through a channel you trust.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR expiry checker](/qr-expiry-checker) before you trust a code you did not expect.
- Inspect the code with the [QR print proof checklist](/qr-print-proof-checklist) before you trust a code you did not expect.
- Check the address with the [QR redirect chain viewer](/qr-redirect-chain-viewer) before you trust a code you did not expect.
- Practise spotting patterns with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
- Review the chain with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Keep a record with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
- Plan protection with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
