# How are query calls verified

**URL:** <https://forum.dfinity.org/t/how-are-query-calls-verified/8464>\
**Category:** Developers\
**Created:** [November 9, 2021, 3:26pm UTC](https://forum.dfinity.org/t/how-are-query-calls-verified/8464 "2021-11-09T15:26:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hazel](https://avatars.discourse-cdn.com/v4/letter/h/e56c9b/32.png) [@Hazel](https://forum.dfinity.org/u/Hazel)\
**Post date:** [November 9, 2021, 3:26pm UTC](https://forum.dfinity.org/t/how-are-query-calls-verified/8464/1 "2021-11-09T15:26:55Z")

</div>

I received an interesting question on twitter. Not quite sure the answer

> One thing has been bothering me for a while: since data transfer (pulling data from a subnet node) occurs outside of a subnet’s consensus, how this charge be trustless? If not trustless, any subnet node would be able to steal Cycles from any user/canister, right?

[https://twitter.com/bitgulu](https://twitter.com/bitgulu)

Hopefully someone can chime in.

---

<div class="post-metadata">

**Author:** ![nomeata](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/nomeata/32/733_2.png) [@nomeata](https://forum.dfinity.org/u/nomeata)\
**Post date:** [November 9, 2021, 6:04pm UTC](https://forum.dfinity.org/t/how-are-query-calls-verified/8464/2 "2021-11-09T18:04:00Z")

</div>

Query calls are not verified, so a _single_ node can make up arbitrary responses. If this is bad for your application (i.e. you want the user to be able rely on their account balance or chat inbox), then use update calls, or use certified variables.

But query calls cannot modify state, so they cannot be used to “steal” cycles, only waste them - like update calls.