Telegram QR Code Login Phishing: Never Scan a Sent Code

Scanning is the step that gives permission

When you log in to Telegram Desktop or Telegram Web, the computer shows a QR code. You open Telegram on your phone, go to Settings, Devices, Add Device, and scan it. The computer is then logged in to your account. See logging in to Telegram Desktop with a QR code.

So the rule is simple: scanning a login QR code opens your account to whichever device is showing that code. The phone that scans gives permission; the screen that shows the code receives it.

How the phishing version works

1. The scammer opens Telegram Desktop or Web on their own computer, which shows a login QR code.
2. They capture that code and send it to you as "identity verification", "join the giveaway" or "confirm to enter the group".
3. You scan it with Add Device. Their computer is now logged in to your account, with your whole chat history.

Telegram warns about exactly this. If you scan such a code with your phone's normal camera, the app explains: "This code can be used to allow someone to log in to your Telegram account. To confirm Telegram login, please go to Settings > Devices > Scan QR and scan the code." That warning describes what the scammer wants you to do.

Which QR codes are safe to scan

If your account has Two-Step Verification, the computer being logged in still asks for your password after the scan, and a scammer who does not know it is stopped there. That is one more reason to keep it on; see a security baseline in fifteen minutes.

If you scanned one

1. Open Settings, Devices on your phone and end every device you do not recognise, or use Terminate All Other Sessions. If Telegram refuses because you just logged in, see the 24-hour wait.
2. Turn on Two-Step Verification, or change its password if it was already on.
3. Check whether strange messages went out in your name, and warn your contacts through another channel.