Three testers tried to scan each other's QR codes: A scanned B, B scanned C, and C scanned A. The testers were not able to complete the task.

In an earlier round of testing we encountered a similar problem with invitation codes.

The first step we should take is to detect that the device we've connected to isn't the same device we scanned, and show a helpful error message. But we may need to consider a more fundamental change: is it possible to design the key agreement protocol to accommodate what the users are trying to achieve?