Last week someone in r/ValorantTradingPost posted a screenshot that made my stomach drop. They were halfway through selling a Reaver Vandal account when the buyer asked them to "prove you own it, just scan this QR code in the Riot Mobile app." They scanned it. Thirty seconds later they were locked out of their own account. The QR was never a verification tool. It was the scammer's own login request, and the seller had just approved it for them.
This is the Valorant QR code scam, and it's spreading fast because it copies the exact motion Riot taught everyone to trust. If you've ever set up multi-factor authentication, you've scanned a QR from your Riot account page. Scammers know that. They've turned a security step into a handoff, and most people approve it without realizing what they're looking at.
How does the Valorant QR code scam work?
When you sign in on the Riot Mobile app or link a new session, Riot shows a QR code that authorizes that device. Scan it while you're logged in and you approve the login. The whole trick is that the scammer generates that QR code on their own phone, then sends it to you wrapped in a story about verification.
So the buyer, or a "middleman" who showed up to vouch for the deal, says: open Riot Mobile and scan this to confirm the account is really yours. You scan it. You aren't confirming anything to them. You're approving their device's login into your account. They're inside before you've finished typing your next message.
A second version skips the QR and uses the approval prompt instead. The scammer triggers a sign-in on your account, so your phone buzzes with an "Approve this login?" notification. At the same moment they DM you: "I sent a test ping through the trade system, approve it so it links our accounts." You tap approve and the session is theirs.
Both versions work for the same reason. The prompt looks identical to the one you see during a normal login, because it is one. Nothing on the screen tells you a stranger is on the other end.
Why the Valorant QR code scam is spreading now
Riot rolled out mobile verification this spring to cut down on smurfing, which means more players than ever are scanning QR codes and tapping approval prompts as a normal part of account setup. The muscle memory is fresh. When scanning a code feels routine, a malicious one slides through without a second look. Traders started flagging this method in late May, and the reports have kept climbing since.
Red flags that you're being set up
A buyer or middleman asks you to scan any QR code they send you. Real ownership is never proven by scanning something the other person provides.
A login approval prompt appears that you didn't trigger, especially right after a chat about "verifying" the account.
They manufacture urgency: scan it now before the listing expires, the bot will cancel the trade, the timer is running.
They claim a marketplace or "trade system" needs you to link your account by approving a prompt. No real platform asks you to approve a Riot login to finish a sale.
The code or link comes through a Discord DM or a screenshot instead of the marketplace itself.
What real ownership verification looks like
You prove an account is yours by doing things only the owner can do, on your own screen, using nothing the buyer hands you. Log in and screen-share the store, the match history, and the owned skins live. Change the in-game name to a random word the buyer picks and show it updating. Open the Riot account page and show the registered email with the middle blurred out. None of that requires you to scan or approve anything.
A buyer proving they actually paid is a separate thing, and it should always run through the marketplace's escrow, not through your phone.
If you're on the buying side, flip the whole thing around. A seller who wants you to scan or approve something is usually trying to keep their own access after you pay. That's the recall scam in a new outfit.
What to do today
Make one rule and keep it: you will never scan a QR code or approve a login prompt that someone sends you during a trade, whatever they call it. Verification happens on your screen, never theirs.
Open your Riot account page right now, check the active sessions, and sign out of anything you don't recognize.
Turn on email MFA if you haven't, so a single stray approval isn't the only thing between a scammer and your account.
Keep every step of the deal inside a marketplace with escrow. The moment someone pulls you into a Discord DM to "verify," the protection is gone.
If you already scanned something and got locked out, move fast. Change your Riot password from a device that's still signed in, revoke the active sessions, and contact Riot Support with your account details. Killing that session quickly is the difference between losing an afternoon and losing the account.