Apple ID QR Code Scam: What It Is and What to Do

How the Apple ID QR code scam works

Attackers build a convincing clone of Apple's sign-in page — same logo, same layout, same URL structure at a glance. They encode a link to that fake page inside a QR code, then place the code where iPhone users will scan it.

The fake login prompts you to enter your Apple ID and password. Some versions go further: after you submit, they ask for your two-factor authentication code, completing the account takeover in seconds.

These QR codes appear in several places:

• Emails claiming your Apple ID has been locked or compromised
• Fake "Apple Support" flyers posted in cafes, libraries, or campus bulletin boards
• Retail store displays with stickers placed over legitimate QR codes
• Fake prize or gift card notifications in physical mail

Apple will never ask you to scan a QR code to verify your identity or unlock your account. If a code leads to a login screen for any Apple service, treat it as a red flag — even if the page looks identical to the real thing.

This is the same core mechanic behind quishing attacks — using a QR code to bypass email link scanners and deliver a phishing page directly to your phone.

What attackers get when the scam works

Your Apple ID is the key to a substantial amount of your digital life. With your credentials, an attacker can:

• Access iCloud Photos, Contacts, Notes, and Messages backups
• Make purchases on the App Store using saved payment methods
• Lock you out of your own account by changing the password and recovery email
• Use Find My iPhone to track your location or remotely wipe your device
• Reset passwords for other accounts that use "Sign in with Apple"

Account recovery after a full Apple ID takeover can take days. Acting in the first few minutes — before the attacker changes your recovery information — is what determines whether you get your account back quickly.

What to do right now

If you entered your Apple ID credentials after scanning a suspicious QR code, move fast.

1. Change your Apple ID password immediately. Go to appleid.apple.com from a trusted device — not the device you used to scan the code — and change your password now.
2. Turn on two-factor authentication if it isn't already active. This makes your account far harder to access even with the correct password.
3. Review trusted devices. In your Apple ID settings, check the list of devices signed in to your account. Remove any you don't recognize.
4. Check recent sign-in activity. Look for logins from unfamiliar locations or devices in the Security section of your Apple ID account page.
5. Revoke any active sessions you don't recognize. Sign out of all devices if you're unsure which sessions are legitimate.
6. Report the scam. Forward a screenshot or description to reportphishing@apple.com and file a complaint at reportfraud.ftc.gov.

For a full recovery checklist after any suspicious scan, see what to do if you scanned a suspicious QR code.

How to protect yourself before you scan

The attack only works if you open the fake page. One check before you tap is all it takes to stop it.

• Scan with QRsafer first. It checks the destination URL against multiple threat intelligence sources and returns a Safe, Risky, or Dangerous verdict before your browser loads anything. A fake Apple login page will not pass a threat check.
• Verify the domain, not just the page design. Fake Apple pages look authentic. The URL is what gives them away — look for anything other than apple.com or appleid.apple.com.
• Never log in to Apple via a QR code. Apple doesn't prompt account verification through QR codes. If a code leads to a login page, don't enter anything — go directly to the Apple website from your browser.
• Look for signs of physical tampering. A sticker placed over an existing code, a code that doesn't match the surrounding print, or a code in an unusual location are all warning signs.

For a broader guide on identifying suspicious codes before you commit, how to spot a malicious QR code before you scan covers the visual and contextual signals that flag a fake.

Frequently asked questions