The short answer
A Telegram QR code scam puts the dangerous part inside a picture, where a text filter sees nothing. The worst kind shows a Telegram login QR code as a verification step: scanning it from your Devices settings logs the scammer into your account. Never scan a code to verify, and end unknown sessions in Settings, under Devices.
Key facts
- Telegram logs in a new device when an already logged-in app scans the QR code that device shows. A scammer can show you that code.
- Telegram's own apps describe a login QR this way: the code can be used to allow someone to log in to your Telegram account.
- Real group verification never needs a QR scan with your account, and never needs your login code.
- A filter that reads only text sees a picture as a picture. The scam text and the link inside it pass unread.
- QR codes are not bad in themselves. Telegram lets any invite link be turned into one.
- Telegram's permissions restrict kinds of content for all members at once. Limits for newcomers only need a bot.
Why do scammers use pictures and QR codes?
Because most filters read text, and a picture has no text. A sentence typed into a screenshot is pixels. A link inside a QR code is pixels. A word list, a link blocker and a keyword bot all look at the message and find nothing to check.
There is a second reason. A QR code hides where it goes. You cannot read the address before you scan it, and on a phone the scan often opens the destination at once.
What do these scams look like?
| Scam | What you are shown | What scanning or following it does |
|---|---|---|
| QR login hijack | A "verification" page or picture with a Telegram login QR code | Logs the scammer's device into your Telegram account |
| "Scan to verify" bot | A bot or page that says new members must scan to prove they are human | The same, or sends you to a page that asks for your login code |
| Wallet QR code | A code to "claim", "sync" or "validate" with your crypto wallet | Connects your wallet to the scammer's site, which then asks you to approve a request |
| Scam text in a picture | A screenshot of an "announcement", a giveaway or a job offer, with a link or a handle to message | Moves you to a site or a private chat where the real scam happens |
| "Scan to claim" | A picture with only a QR code and a promise | Opens a link nothing in the chat could check |
The giveaway and claim pitches also arrive as plain text. Airdrop and giveaway scams covers that side.
How does the QR login hijack work?
It abuses a real Telegram feature. When you log in on a new computer, Telegram shows a QR code on that screen. You open Settings > Devices on your phone and scan it. The new device is then logged in.
The scammer starts that login on their own device and gets a code. They show it to you on a page that looks like a verification step. If you scan it from your Devices settings, you have just linked their device. They can read your chats, message your contacts as you, and take over groups you manage.
Telegram's own apps describe a login code plainly: it can be used to allow someone to log in to your Telegram account. Only scan one that is on your own screen, from a login you started yourself.
A related theft asks for the login code Telegram sent you. Telegram says those codes should never be shared with anyone.
What should members do?
- Never scan a code to "verify". Real verification is a button, a puzzle or a question inside Telegram.
- Never scan a login QR you did not start. If you are not logging in on a new device right now, there is nothing to scan.
- Treat a QR code as a link you cannot read. If the same offer as a plain link would look wrong, the code is wrong too.
- Do not connect a wallet from a code in a chat. Go to the project's site yourself, from an address you already trust.
- Report it. Tap the message and choose Report, then tell the group's admins.
If you already scanned:
- Open Settings > Devices and terminate every session you do not recognise.
- Turn on 2-Step Verification under Settings > Privacy and Security.
- If a wallet was involved, disconnect the site, revoke approvals, and move what is left to a new wallet.
- Tell your contacts and the group. The scammer may already be writing as you.
What can admins do?
- Restrict media if the group does not need it. Telegram's Permissions can stop all members from posting specific kinds of content.
- Restrict media for newcomers only. Most scam accounts post their one picture early. Telegram's permissions apply to everyone at once, so limits for new members only need a bot.
- Pin the rule. "We will never ask you to scan a QR code or share a code to verify."
- Audit your verification bot. Check its exact @username, and what it asks new members to do. See how to protect a group from scammers.
- Use a bot that reads pictures. It should read the text inside an image, decode a QR code, and judge both as if they had been typed.
Do not ban QR codes outright unless you want to. They have honest uses: Telegram lets any invite link be turned into one.
Targa reads pictures on every plan. Photos, stickers, image files and video covers are read like text. A pitch typed into a screenshot, or a link hidden in a QR code, is checked exactly like a plain message. It can also limit links and media for new members during their first days. Every action carries a reason you can read with /why.
The limits, stated plainly. Text inside images is read in English, Russian and Chinese, plus the language your group is set to. A picture written in another language can be missed. And Targa sees your group, not the scammer's website or your members' private chats. A code sent in a private message never passes through a bot. That is why the pinned rule matters. For the private-message side, see the fake admin scam, and to see what your group exposes, run the free group check.
Common questions
Can someone take over my Telegram account with a QR code?
Yes, if it is a Telegram login code and you scan it from Settings, under Devices. That is how Telegram links a new device. The scammer opens a login screen, shows you its QR code as a verification step, and your scan logs their device into your account.
I scanned a QR code and now I am worried. What should I do?
Open Settings, then Devices, and terminate every session you do not recognise. Turn on 2-Step Verification under Privacy and Security. If you connected a wallet, disconnect the site in the wallet, revoke any approvals you gave, and move your funds.
Why did my group's filter not catch a scam posted as a picture?
Because it reads text, and a picture has none. The pitch, the link and the QR code are all pixels. Catching them takes a bot that reads the text inside images and decodes QR codes, then judges what it finds.
Is it safe to scan a QR code posted in a Telegram group?
Treat it as a link you cannot read. A QR code posted by a new account that promises a reward, a verification or a claim is almost always a scam. One posted by the project's known admins for a known purpose, such as an invite link, is normal.
Should I ban pictures in my group?
Only if your group does not need them. Telegram's permissions switch media off for all members. A gentler option is to block media for new members only and lift the limit later, which takes a bot.
See what a scammer sees in your group
The free group check reads a group's public signals and shows where it is exposed. No account needed.