QR Code Prize Scams: Check Before You Scan or Sign In
A QR code is a way to open a destination, not a certificate that the destination is trustworthy. A prize poster, email or unexpected package can place a code in front of you before you have considered who created it. This guide focuses on that moment of decision.
What is a QR code prize scam?
In a prize-themed example, a code leads to a page promising a reward and requesting a login, payment or personal details. The code is simply the route to the page. The important questions are who controls the destination and why the requested information is necessary.
The UK NCSC explains that QR codes can conceal phishing links, a technique often called quishing. It does not say every QR code is dangerous. Its discussion distinguishes ordinary uses from suspicious messages and recommends the scanner built into your phone.
Preview the destination without treating it as proof
If your camera offers a link preview, examine it before opening. A preview can help you notice a strange address, but a familiar word within an address does not establish ownership. If the destination is unclear, use an independently known website instead.
The FTC’s QR-code warning recommends inspecting a link for signs such as misspellings and being cautious about unexpected codes delivered in messages. Do not let an urgent instruction prevent that check.
A fictional example: the prize collection poster
Imagine a poster outside a shop says “Scan to collect your reward”. After scanning, you see a page requesting your email password. The poster’s location does not explain why collecting a reward would require access to your email. Ask the shop through its normal contact route whether it recognises the promotion; do not use the page’s own support chat as your only confirmation.
This example shows why context matters. A normal-looking physical location can make a digital request feel familiar. The request still needs to make sense on its own.
Unexpected packages need a separate check
An item arriving at your address is not proof that you requested it or that a code inside it is safe. The FTC has warned about unexpected packages containing QR codes that lead to phishing pages. Check order records independently rather than scanning a code to discover a supposed sender.
A short before-you-act checklist
- Was I expecting this message, poster instruction or delivery?
- Can I identify the organisation without relying on the code?
- Does the requested action fit the stated purpose?
- Is there a normal website or contact route I can use instead?
- Am I being pushed to act before checking?
Frequently asked questions
Does scanning always mean my account is compromised?
No. Record what happened after the scan: opening a page, entering credentials, approving a request and installing software are different events. Use the fake-link response guide to choose the relevant next step.
Should I install a special scanner to collect a prize?
An unexpected promotion is not a good reason to install unfamiliar software. Stop and verify the request independently.
For messages delivered directly to your phone, see how to check an unexpected winning message.
Educational consumer-safety information. Lottery participation is gambling, not a reliable income source. Do not chase losses; seek local support if gambling is causing harm. Reporting and account-recovery procedures vary by country and provider.