Gmail QR Code Scam: What It Is and What to Do
If a QR code told you to verify Gmail, recover a Google Account, or review a security alert, pause. Real Google account management happens through Google's own apps and domains. A QR code in an unexpected message is often a phishing shortcut.
How the scam works
Attackers send an email, text, PDF, or chat message that looks like a Google security notice. The message says your Gmail account has unusual activity, your storage is full, your recovery email expired, or your password must be confirmed. The QR code sends your phone to a lookalike Google sign-in page.
If you enter your password there, the attacker can try to enter your real account immediately. In some versions, the page asks you to approve a device prompt or grant access to a third-party app. That can leave an active session or permission behind even after you close the browser.
This is a form of quishing, where the QR image hides the destination from ordinary email link scanning.
What to do right now
- If you only scanned and closed the page: you are probably fine. Do not return to the page. Delete the message and report it as phishing.
- If you entered your password: type myaccount.google.com directly into your browser, change your password, and choose a password you do not use anywhere else.
- Review Security activity: sign out devices you do not recognize, revoke unfamiliar third-party app access, and turn on 2-Step Verification.
- Check Gmail settings: look for unknown forwarding addresses, filters, delegated mailbox access, and recovery options the attacker may have changed.
If your Gmail is tied to banking, social media, or work tools, secure those accounts next. Your inbox is often the reset path for everything else.
How to spot a fake Google QR code
- The message creates urgency about account suspension or unusual activity.
- The sender is not a Google-controlled domain.
- The QR destination uses a URL shortener or a lookalike domain.
- The page asks for your password after you arrived from an unsolicited code.
For a deeper recovery flow, use the guide on what to do after a fake login page.
Frequently asked questions
Does Google send QR codes for Gmail security alerts?
Google may use QR codes in some sign-in and device-linking contexts, but an unsolicited email or text with a QR code asking you to verify Gmail or fix your Google Account should be treated as suspicious. Go directly to myaccount.google.com instead of scanning the code.
What should I do if I entered my Google password after scanning a QR code?
Change your Google password immediately from a trusted device, review recent security activity, sign out unknown sessions, enable 2-Step Verification, and revoke third-party app access you do not recognize.
Can a Gmail QR code steal my account automatically?
No. The scan itself does not steal your account. The risk starts if the QR code opens a fake Google login page and you enter your password, approve a prompt, or grant account permissions.
How can I tell if a Google QR code is real?
Use the Google app or myaccount.google.com directly. If a QR code opens a login page, the domain should be accounts.google.com. Misspellings, URL shorteners, urgency, or requests from unexpected senders are warning signs.
Check account-security QR codes before opening them
QRsafer previews the destination and checks for risky signals before your browser opens the page.