Google Authenticator QR Code Scam: What It Is and What to Do
Google Authenticator uses QR codes for real MFA setup. That does not mean every authenticator QR code is safe. If the code came from an email, chat, support message, PDF, or stranger, treat it as suspicious until you verify the account settings yourself.
Legitimate setup versus a scam
The safe version starts after you log in to the real service, open security settings, choose an authenticator app, and scan a setup QR code shown by that service. The risky version starts with someone pushing you to scan first.
- A fake IT email says your MFA expires unless you scan a code.
- A support impersonator asks you to scan a code to "secure" your account.
- A PDF invoice or HR form includes a QR code for account verification.
- A page copies Google or Microsoft branding and asks for your password or one-time code.
This is closely related to QR-based two-factor authentication scams and Gmail QR code scams.
What to check now
- Open the real account yourself. Do not use the QR page. Type the site address or use the official app.
- Change the password if you entered it after scanning the QR code.
- Review MFA methods and remove any authenticator, phone number, passkey, or recovery option you do not recognize.
- Sign out of active sessions and revoke connected apps that look unfamiliar.
- Contact IT if the code involved a work, school, VPN, payroll, email, or admin account.
If the scan sent you to a login screen, follow the steps for a fake QR login page.
Frequently asked questions
Can a Google Authenticator QR code be a scam?
Yes. A legitimate authenticator QR code starts inside the account security settings of the service you are protecting. A QR code sent by email, chat, text, or a fake support agent can be part of a phishing or device-linking scam.
Did scanning an authenticator QR code give someone my codes?
Scanning can add a time-based code entry to your authenticator app, but the bigger risk is that the attacker tricked you into adding their setup flow, entering your password, or approving a login elsewhere.
What should I do after scanning a suspicious authenticator QR code?
Open the real account security page yourself, change the password, revoke active sessions, review MFA methods, remove unknown authenticator entries, and contact IT if it involved a work account.
Are authenticator QR codes always unsafe?
No. Authenticator QR codes are normal during MFA setup when you start from the official account settings. The warning sign is a code that arrives unexpectedly or asks you to scan before you verify the account and domain.
Check account-security QR codes before opening them
QRsafer previews the destination so you can spot suspicious account-security and login links before a page opens.