QR Code Scams on Telegram
Fraudsters distribute malicious QR codes through Telegram channels and DMs, redirecting victims to phishing pages, credential-harvesting login screens, or cryptocurrency payment requests.
Part of: QR-Code Scams (Quishing)
Last reviewed: 1 June 2026
QR code scams on Telegram exploit the platform's image-sharing capability to deliver scannable codes that appear to offer access to exclusive content, discount coupons, or cryptocurrency airdrops. Because QR codes mask the destination URL, recipients cannot assess the safety of the link before scanning.
The Telegram context adds plausibility: codes shared in investment, crypto, or giveaway channels appear relevant to the community's interests, and the expectation of exclusive access lowers scepticism.
How this scam works on Telegram
A Telegram channel or DM shares a QR code described as a gateway to an exclusive group, a cryptocurrency airdrop, a discount offer, or a login shortcut. When scanned, the code opens a phishing page requesting account credentials, payment card details, or directs the user to send cryptocurrency to a wallet address.
Some variants use QR codes within fake 'authentication' flows: the victim is told to scan the code to 'link' their Telegram account for security purposes, when in reality the scan session-hijacks their Telegram account using Telegram's own QR login feature.
Other operators embed QR codes in PDF documents distributed through Telegram as apparent investment guides or event tickets, ensuring the code survives any platform-level link scanning.
Common red flags
- QR code shared in a Telegram channel offering exclusive access, airdrops, or discounts
- QR code framed as a security verification or account-linking step
- PDF or image attachment containing a QR code directing to an external site
- QR code destination URL that leads to a page requesting credentials or cryptocurrency payment
- Channel or bot that distributes QR codes to all members rather than responding to specific requests
- Pressure to scan quickly before the offer expires
How to protect yourself
- Preview the URL decoded from any QR code before visiting it — most phone cameras show the URL before opening
- Never scan QR codes sent via Telegram to 'verify' or 'link' your account
- Do not connect your Telegram account via QR login on any site reached through a Telegram message
- Report channels distributing suspicious QR codes to Telegram
- Avoid scanning QR codes in PDF attachments from unverified Telegram sources
How to report it
- Report the Telegram account or channel using the in-app 'Report' function and select 'Fraud'
- Submit any phishing URL decoded from the QR code to your national cybercrime reporting service
- Alert Telegram's @notoscam bot by forwarding the message containing the QR code
Frequently asked questions
Can scanning a QR code on Telegram log a scammer into my Telegram account?
Yes. Telegram's QR login feature allows account access by scanning a code displayed on a desktop browser. If you scan a QR code provided by a scammer and it opens a Telegram web login prompt, your account can be taken over. Never scan QR codes presented as Telegram verification steps from unverified sources.