Identify the purpose before scanning
A code may be a public download link, a temporary sign-in action or private configuration. Read the surrounding instructions and verify the source. Do not assume that two similar-looking codes perform the same task.
An unexpected message asking you to scan a code to keep an account active deserves particular care. NCSC guidance warns that unexpected QR codes can be used to add another party’s device to a messaging account.
Keep private codes out of screenshots
If an app uses a code to move account information to another device, include it in the list of areas to redact. Hiding a nearby password field does not remove a credential encoded elsewhere.
Do not upload the code to an unfamiliar decoding website to find out what it contains. That may transmit the very information you wanted to protect. Use a trusted local method or ask the verified developer how the code is intended to be handled.
Verify the destination and requested action
When a trusted scanner shows a destination or action, read it before continuing. A familiar logo next to the code does not establish that the destination belongs to the same organisation.
For account linking, confirm which account and device are involved. Do not share verification codes or approve an unfamiliar device merely because a message claims to be support. Genuine support should be identified through the published contact route.
Respond to a mistaken disclosure
If a private code was shared, ask the actual service whether the token expires, can be revoked or requires a credential change. Do not assume that closing the QR screen invalidates every code.
If an unfamiliar session appears in an account that supports session management, follow that provider’s recovery guidance. Keep the recovery process separate from a streaming setup enquiry and protect the email account used for account recovery.
Questions about this guide
Is a QR code just a public picture?
No. Its encoded data can be private even though it is displayed as an image.
Should I scan a support message’s code without checking it?
No. Verify the source, destination and account-linking action first, particularly when the request was unexpected.