Fortnite QR Code Scam: Free V-Bucks Fraud, Fake Giveaways, and Phishing

The four Fortnite QR code scams

Variant 1 — "Free V-Bucks generator" credential phishing. The most widespread vector. YouTube videos, TikTok posts, and Discord messages advertise a "V-Bucks generator" with a QR code that leads to a fake Epic Games login page. When the player enters their username and password, those credentials go directly to the attacker. The attacker then drains any stored V-Bucks balance, makes purchases with saved payment methods, and may sell or lock the account. These pages look convincing — they often copy Epic Games' actual UI pixel-for-pixel. The only reliable tell is the URL, which is never epicgames.com. Using a QR code safety checker to preview the destination before the page loads is the fastest way to catch these.

Variant 2 — Fake "Chapter exclusive" or "Battle Pass giveaway" QR codes. QR codes appear in YouTube video descriptions, TikTok comments, Instagram bios, and Discord "giveaway" channels promising an exclusive skin, a free Chapter Battle Pass, or thousands of V-Bucks to a randomly selected winner. Scanning leads to a phishing page or a subscription-trap site that charges weekly or monthly fees that are difficult to cancel. These campaigns are timed around new season launches and Chapter releases, when player excitement is highest and skepticism is lowest. The fake giveaway QR code scam playbook is identical across gaming platforms — urgency and the fear of missing out are the primary levers.

Variant 3 — Physical QR codes near schools. Scammers print flyers advertising "free Fortnite skins," "free V-Bucks," or "Fortnite tournament sign-up" and post them on school bulletin boards, locker doors, and community boards in neighborhoods with younger populations. Scanning these leads to Epic Games credential-harvesting pages or subscription-trap sites. Epic Games has no program that distributes promotional materials through physical flyers — if a QR code near a school promises Fortnite rewards, it is a scam without exception.

Variant 4 — Fake tournament entry fee fraud. Scammers impersonate Fortnite esports organizers on Discord, Reddit, and Instagram, promoting "open tournaments" with cash prizes. Players are asked to pay a buy-in fee by scanning a QR code and transferring money via Venmo, Cash App, or a payment page. The money is collected and the tournament never materializes. Legitimate Fortnite competitive events run through Epic's official FNCS (Fortnite Champion Series) platform, which has no entry fees for open qualifier rounds. Any third-party asking for a QR code payment to enter a Fortnite tournament is running a scam.

Epic Games never sends V-Bucks through QR codes

This rule has no exceptions: Epic Games never distributes free V-Bucks, skins, or Battle Pass access through QR codes, third-party websites, or any channel outside the official Fortnite client. V-Bucks are purchased inside Fortnite on your platform (PlayStation, Xbox, Nintendo Switch, PC, or mobile) or at authorized major retailers. There is no "generator," no "claim page," and no "partner site" that can add V-Bucks to your account.

Phishing pages targeting Fortnite players use domain names designed to look official — for example "epicgames-vbucks.com," "fortnite-generator.net," or URLs with subtle letter substitutions. A legitimate Epic Games URL will always be on the epicgames.com domain. Before scanning any QR code that promises gaming rewards, preview the destination URL first — it takes three seconds and eliminates nearly all risk.

Fortnite's player base skews young, which makes these scams especially damaging. Children and teens are less likely to recognize phishing indicators and more likely to act on the urgency or excitement a fake giveaway creates. Parents and guardians can reduce risk by enabling two-factor authentication on the family Epic Games account, removing saved payment methods when not in active use, and discussing what legitimate game rewards look like — always inside the game, never through a QR code or a third-party site.

What to do if you already scanned

Your response depends on how much information was submitted.

If you scanned but did not enter any information: You are almost certainly safe. Close the browser tab, clear your browser cache, and do not return to the page. Landing on a phishing page without submitting anything does not compromise your account.

If you entered your Epic Games username and password:

1. Go immediately to epicgames.com/account on a trusted device and change your Epic Games password.
2. Enable two-factor authentication under Account Settings → Password & Security if it is not already active.
3. Check your V-Bucks balance and transaction history for unauthorized purchases.
4. Remove any payment methods stored on the account if unauthorized charges appear.
5. Change the password on your email account and any other account using the same credentials.
6. Contact Epic Games Support at epicgames.com/help to report the compromise and request a review of recent account activity.

If you entered payment card details or paid a "tournament fee": Call your bank or card issuer immediately to report potential fraud, dispute the charge, and request a new card number if card details were entered on an unknown site.

Report the phishing site to the FTC at reportfraud.ftc.gov and to the platform where you encountered the QR code. For a complete post-scan recovery checklist, see what to do if you scanned a suspicious QR code.

Frequently asked questions