Steam Gift Card QR Code Scam: How It Works and What to Do
Someone is pressuring you to buy Steam gift cards and scan a QR code to complete the transaction. Here's why this is always a scam, how the QR code fits into the scheme, and the steps to take right now if you've already paid.
Why scammers use Steam gift cards
Steam gift cards are available at virtually every major retailer — Target, Walmart, CVS, GameStop, Best Buy. An attacker can instruct a victim to purchase one in minutes, before the victim has time to think or consult someone. Unlike a bank wire, there are no hold periods or fraud flags at the point of purchase.
More importantly, once a Steam wallet code is redeemed it cannot be reversed. Valve does not process chargebacks on digital codes. This irreversibility is the entire point — it is the same logic behind crypto QR code scams and why gift cards appear in so many other scam scripts.
What the QR code actually does
Traditionally, gift card scammers ask victims to scratch off the PIN and read it aloud or photograph it. The QR code step is a more modern, frictionless version of the same theft. When you scratch off the PIN strip on a Steam card, a QR code is often revealed alongside the alphanumeric code. Scanning that QR code with your phone's camera opens a page — controlled by the scammer — that captures the code the moment you land on it.
The QR code feels official because it is printed on the physical card. But the destination URL behind it can be replaced by a sticker, or the scammer may send you a completely separate QR code claiming it is the "redemption portal." Either way, scanning it hands the attacker the code before you ever reach Steam.
The legitimate way to redeem a Steam gift card is only through the official Steam client or at store.steampowered.com/account/redeemwalletcode — nowhere else.
Common impersonation scripts
The setup varies, but the pressure pattern is consistent:
- Boss or executive impersonation. A text or email appearing to come from your manager asks you to purchase Steam cards urgently for a client or surprise giveaway, and promises reimbursement. The sender address is spoofed or a lookalike domain.
- Online "friend" or romance contact. Someone you've met online but never in person claims to be in trouble — stranded, hospitalized, or locked out of their account — and asks you to help by sending Steam cards via QR code.
- Fake giveaway or prize. You're told you won a gaming bundle, a cash prize, or a Steam credit top-up. To "unlock" the reward, you must first purchase a card and scan a QR code to verify your identity or pay a release fee. This is the advance-fee variant — you always lose what you send.
- Government or tech support impersonation. A caller claiming to be from the IRS, Social Security, or Microsoft support demands payment to avoid arrest or account suspension. They specify Steam cards because those are what a gaming-adjacent target is most likely to have or buy quickly.
In every case, the request combines three elements: urgency, secrecy ("don't tell anyone"), and an unusual payment method. All three together are a reliable fraud signal regardless of how convincing the story sounds. See also: the broader gift card QR code scam guide.
What to do right now
If you have not yet scanned the QR code: Stop. Do not purchase any cards, and do not scan any QR code sent to you by the person making this request. Verify the situation through a completely separate channel — call your actual manager on a number you already have, or call the company's main number. No legitimate scenario requires emergency gift card purchases.
If you already purchased cards and scanned the QR code:
- Contact Steam Support immediately at help.steampowered.com. Report that you were fraudulently induced to share the code. If the code has not yet been redeemed, Steam may be able to deactivate it.
- Call the store where you bought the cards and report gift card fraud. Some retailers can flag cards for deactivation before redemption if you act fast enough.
- If you paid by credit card to buy the gift cards, call your card issuer immediately and dispute the purchase as fraud.
- File a report with the FTC at reportfraud.ftc.gov and with the FBI at ic3.gov. Include screenshots of all messages and the QR code you were sent.
For a full recovery checklist after any suspicious scan, see what to do if you scanned a suspicious QR code.
Frequently asked questions
Why do scammers ask for Steam gift cards and a QR code?
Steam cards are sold everywhere, redeemable instantly, and irreversible once used — the ideal combination for fraud. The QR code step removes friction: instead of reading a code aloud (which gives victims time to pause), scanning hands the code to the scammer the moment the page loads.
My boss texted me to buy Steam gift cards urgently and send a QR code — is this a scam?
Yes. This "boss impersonation" script is one of the most common gift card scam variants. No legitimate employer sends emergency instructions to purchase gift cards via text. Before doing anything, call your manager directly using a phone number you already have — not the number the message came from.
I already bought Steam gift cards and scanned a QR code — can I get my money back?
Contact Steam Support at help.steampowered.com immediately — if the code hasn't been redeemed yet, there is a chance Steam can deactivate it. Also call the store where you bought the cards and your credit card issuer if you paid by card. File reports with the FTC (reportfraud.ftc.gov) and FBI (ic3.gov). Recovery is not guaranteed, but acting in the first few minutes gives you the best chance.
Check any QR code before you scan it
QRsafer previews the destination URL and checks it against threat intelligence before your browser opens anything. Free on iOS and Android — takes two seconds.