What happened
A QR login is account authorization rather than a harmless picture. Treat a request to scan a code as seriously as a request to sign into a new browser. The Steam branding around a code does not explain which session will receive access. Begin with your own intent: were you actually trying to log in, and do you recognize the requesting destination?
What to check
Start the login yourself at the official service you intend to use. Before approving, read the request details presented by your Steam mobile app and compare them with that deliberate action. Refuse codes sent unexpectedly through chats, giveaways, supposed support messages, or someone else’s screen. Do not publish a live login challenge in a group while asking whether it looks legitimate; the challenge itself concerns account access.
Worked example
For example, somebody claims that scanning a QR code will verify the rarity of your skin. You did not start any login and cannot identify the requesting session. The story about item verification is not an explanation for authorizing account access. Another person asks you to scan their desktop screen to finish a support check. Their session is not your own intentional login.
Result and next step
The appropriate result is a matched login request or a refused unexpected authorization, not blind approval followed by troubleshooting. If an unfamiliar session was approved, open official Steam account security help yourself from a trusted device. Preserve the sender’s identity and request time without sharing live codes. See Steam security guidance and CASECS2 workflow. Customer recipient checking does not require handing support a personal authenticated Steam browser session.