QR Code Giveaway Scams: How to Inspect the Destination Before Entering
Learn to check QR destinations, verify sponsors independently, spot altered codes, and respond after sharing information.
A QR code giveaway scam uses a scanned code to steer people toward data theft, malware, or a fake prize claim. Before entering, read the destination address without opening it and check the domain for misspellings or switched letters. A polished page is not proof of legitimacy.
The Federal Trade Commission warns that a QR code can lead to a spoofed site designed to look real and capture information entered there.
Verification note: Program terms and availability can change. This page was checked against linked sources on September 09, 2026.
Read the destination before opening it
Pause when your phone displays the destination URL. The FTC advises inspecting that address before opening an unexpected QR code. Focus on the domain—the main website name—not the promotional words elsewhere in the address.
Look for extra characters, misspellings, or switched letters that imitate a familiar sponsor.
- Do not tap immediately.
- Read the complete destination shown.
- Compare the domain with the sponsor's known website.
- Treat a shortened, unclear, or unfamiliar address as a reason to stop.
Verify the giveaway independently
Leave the QR path and reach the sponsor another way. Type a known trusted address yourself, then look for the giveaway and its rules on that site. If the promotion remains uncertain, find the sponsor's contact information independently.
Do not rely on a phone number, email address, or support link supplied by the questionable page. Real sweepstakes do not require a fee, purchase, bank-account number, credit-card number, or Social Security number to claim a prize, according to the FTC's prize and sweepstakes guidance. A request for any of these is a signal to leave rather than continue "verification."
Inspect the physical code
Check the code itself before scanning a poster, package, card, receipt, or display. A sticker may have been placed over the original code; the FBI advises avoiding QR codes that appear altered or tampered with. Also consider how the code reached you.
An unexpected "gift" package does not become trustworthy because it contains your name or a plausible promotion. The FBI documented unsolicited packages whose QR codes sought personal or financial information or attempted to deliver malware, while noting that this variation was not as widespread as other fraud schemes.
Decide what the page should never receive
Do not enter login credentials, personal details, or financial information on a page reached through a questionable code. A copied logo, professional design, or familiar-looking login screen cannot establish who controls the site. Do not make a QR-directed payment to release a prize, cover shipping, confirm eligibility, or unlock a gift card.
Instead, close the page and verify the promotion through the sponsor's independently located website or contact channel.
Act quickly after entering information
If you entered a username and password, change that password immediately through the genuine website or app. Change it anywhere else you reused it, then enable two-factor authentication. The FTC also recommends reviewing credit and financial accounts for unauthorized activity after credentials or sensitive information have been exposed.
Use contact details from the institution's known website, app, card, or statement—not from the QR destination.