QR Code Spam in Telegram Groups: Why It Works and How to Block It

• A poster-style image with a QR code and text such as "Scan for a free bonus".
• A fake "payment receipt" or "delivery notice" with a code to "confirm".
• Screenshots of supposed earnings with a code for the "same strategy".
• Codes that open a Telegram login page, leading to account takeover.

• The link is inside pixels, so link restrictions and keyword filters do not see it.
• Phones open the destination directly, often in a browser that looks trustworthy.
• Images are allowed in many groups because members share photos.

1. Restrict media for new members. Most QR spam comes from fresh accounts. Requiring members to be around for a while before posting images removes most of it.
2. Use topics so images are expected only in certain places, such as a photo topic, making out-of-place posters stand out.
3. Enable join requests if a wave of image spam keeps returning.

• Treat any unsolicited QR code from a non-admin as suspicious by default.
• Do not scan unknown codes to "check" them on your main phone.
• If you must inspect one, use a QR reader that shows the URL without opening it.
• Ban the account and delete all of its messages; QR spam is almost never accidental.

Pin: "Never scan QR codes posted in this group unless an admin posted them." Add a reminder that Telegram itself never asks you to scan a code to claim prizes, and that scanning a code from Telegram's "Link desktop device" screen can hand your account to someone else.

Some communities share event tickets or payment details as QR codes. Make a simple rule: QR codes may be posted only by admins or in a specific topic, with a text explanation of where the code leads.

If members report scanning a malicious code, tell them to check active sessions in Telegram settings, terminate unknown ones and enable two-step verification. Post a short warning in the group without reposting the image.

Image-based ads are tiring to police manually. Xiabao (虾宝) is a free anti-ad bot for Telegram group owners that removes advertising and spam automatically, reducing how long ad posts stay visible. Add @xiabaotg_bot to your group as an admin with permission to delete messages and ban users, and it takes care of the repetitive cases.

Restrict images from newcomers, make QR codes an admin-only tool, and teach members not to scan strangers' codes. These simple steps neutralise one of the most effective modern spam tricks.

Disclosure: this guide mentions Xiabao (虾宝), a free anti-ad bot for Telegram group owners. Every step works with or without it.