# QR Code Spam in Telegram Groups: Why It Works and How to Block It

Text filters and link restrictions work well against classic spam, so spammers moved to images. A QR code in a picture carries a link that no text filter can read, and members scan it with their phone camera without thinking twice.

## What QR spam looks like
- A poster-style image with a QR code and text such as "Scan for a free bonus".
- A fake "payment receipt" or "delivery notice" with a code to "confirm".
- Screenshots of supposed earnings with a code for the "same strategy".
- Codes that open a Telegram login page, leading to account takeover.

## Why it bypasses defences
- The link is inside pixels, so link restrictions and keyword filters do not see it.
- Phones open the destination directly, often in a browser that looks trustworthy.
- Images are allowed in many groups because members share photos.

## Settings that help
1. **Restrict media for new members.** Most QR spam comes from fresh accounts. Requiring members to be around for a while before posting images removes most of it.
2. **Use topics** so images are expected only in certain places, such as a photo topic, making out-of-place posters stand out.
3. **Enable join requests** if a wave of image spam keeps returning.

## Moderator habits
- Treat any unsolicited QR code from a non-admin as suspicious by default.
- Do not scan unknown codes to "check" them on your main phone.
- If you must inspect one, use a QR reader that shows the URL without opening it.
- Ban the account and delete all of its messages; QR spam is almost never accidental.

## Teach members one rule
Pin: "Never scan QR codes posted in this group unless an admin posted them." Add a reminder that Telegram itself never asks you to scan a code to claim prizes, and that scanning a code from Telegram's "Link desktop device" screen can hand your account to someone else.

## Handling legitimate QR codes
Some communities share event tickets or payment details as QR codes. Make a simple rule: QR codes may be posted only by admins or in a specific topic, with a text explanation of where the code leads.

## Example policy
| Situation | Allowed? | Action |
|---|---|---|
| Admin posts event QR with description | Yes | None |
| New member posts poster with QR | No | Delete, ban |
| Regular member shares QR for a group order | Topic only | Move or remind |
| QR leading to a login page | Never | Delete, ban, warn group |

## Respond to incidents quickly
If members report scanning a malicious code, tell them to check active sessions in Telegram settings, terminate unknown ones and enable two-step verification. Post a short warning in the group without reposting the image.

## Automate what you can
Image-based ads are tiring to police manually. [Xiabao (虾宝)](https://xiabao.org) is a free anti-ad bot for Telegram group owners that removes advertising and spam automatically, reducing how long ad posts stay visible. Add @xiabaotg_bot to your group as an admin with permission to delete messages and ban users, and it takes care of the repetitive cases.

## Summary
Restrict images from newcomers, make QR codes an admin-only tool, and teach members not to scan strangers' codes. These simple steps neutralise one of the most effective modern spam tricks.

> Disclosure: this guide mentions Xiabao (虾宝), a free anti-ad bot for Telegram group owners. Every step works with or without it.