The pattern
Displaying a QR code on-screen during a livestream, in a story, or as an image in a post has become a common way to route viewers to a link without them having to type a URL. Most of the time this is completely legitimate — but the format itself creates the same fundamental problem covered in our quishing explainer: you can't tell where it leads until you've already scanned it.
The impersonation risk
A verified account, a large follower count, or a professional-looking post doesn't verify what a QR code shown within that content actually decodes to. Scammers running fake giveaway accounts, impersonating brands, or hijacking a compromised real account can display a QR code that looks completely at home in an otherwise normal-looking post.
"Verify your account" or "claim your prize" QR codes shown in comments or DMs — rather than the account's own actual posts — are an especially common scam pattern, since they often come from accounts impersonating platform support rather than the brand itself.
What to check before scanning
- Does the destination domain match the actual brand or creator, once previewed?
- Is the account posting the code the verified, established account you'd expect — or a similar-looking recent duplicate?
- Is there urgency language ("limited time," "first 100 people") pushing you to scan immediately without checking?
When in doubt, running the code through CheckThisQR before visiting the destination takes only a few seconds.
See the teen-focused version too
Our guide on social media QR scams targeting younger users covers "free followers" and giveaway patterns in more depth.
See that guide →