One household, one family plan
In some cases, Spotify now uses a QR code to check whether members of a Family or Duo plan actually live with the main account holder. The German tech outlet heise online reported on this on 20 October 2026. Spotify describes the process on its support page.
Under Spotify's terms, Premium Family and Duo are meant for people at the same address. Until now, members confirmed this by entering their full address. Spotify says the address is used only for verification and that it does not track location.
How the check works
- The member receives a notification that verification is required.
- The main account holder opens the subscription section in the Spotify app via their profile picture and selects "Manage". The QR code appears there.
- The member scans the code with their own phone's camera. Both people need to be in the same place.
- Members have seven days to scan. Anyone who misses the deadline cannot join another Family or Duo plan for twelve months, according to Spotify. They can still take out their own plan or use the free version.
The scan only works in the mobile app. If it fails, Spotify recommends updating the app on both devices and checking the date and time. According to heise, the check is not yet mandatory for all users.
A changing code stops screenshots, not live relaying
The QR code changes every few seconds, so a photo or screenshot sent by messenger quickly becomes invalid. That does not help against a live feed: heise cites a Reddit user who says they passed the check by sharing their screen in Microsoft Teams.
The pattern is familiar from IT security. A short-lived code only proves that someone could see it at that moment, not where they are. Attackers exploit the same weakness when devices are paired via QR code, as in the Ghost Pairing scam on WhatsApp described by Germany's BSI (report). Spotify's case concerns its subscription model, not an attack, but the principle is the same.
The real verification code only appears in the Spotify app on the main account holder's phone. A QR code in an email, text message or letter that claims to lead to Spotify verification does not match this process. If in doubt, open the app directly instead of using a code or link from a message.
What users should look out for
- • Only scan the verification code directly from the main account holder's phone.
- • Never enter login or payment details on a page you reached via a QR code from a message.
- • Check verification notices in the app itself, in the subscription section.
- • Keep the seven-day deadline in mind to avoid a twelve-month block on other family plans.
Check unknown QR codes before opening them
QRTrust displays a QR code's full destination address and checks it against multiple phishing databases and AI models before it opens.
Check a QR code →Sources
About QRTrust
QRTrust is Germany's first QR code security platform, developed in Dortmund. AI-powered real-time detection, a local threat database and multi-layered security checks protect citizens, authorities and businesses from quishing attacks. GDPR compliant, hosted in Germany.