What is a QR code scam?
Following the pandemic, QR codes emerged as the novel method for check-ins, accessing links, and even placing food orders at restaurants and cafes. However, they have since evolved into fresh bait for phishing schemes.
These QR code scams operate akin to conventional phishing tactics, where perpetrators conceal malicious links within QR codes.
QR code phishing also known as ‘quishing’ will be a scam to watch out for in 2024.
QR code scams in real life
To better understand this emerging scam, Crime Stoppers spoke to a recent quishing victim, who has asked to remain anonymous.
The individual unknowingly scanned a fake code while out at a social gathering with friends, thinking he was scanning a code for the menu.
He did not realise that a sticker was placed on top of a legitimate QR code, “It’s just a clear sticker over the top and I couldn’t tell.”
The code took him to a website where he needed to fill in his details, personal and financial.
Having never been to this establishment he did not recognise that this was not the restaurants regular ordering site.
A mere minute later the victim got a text message from his bank asking whether he had authorised the transfer of a nominal amount of money.
Initially he though the text from the bank was spam, however upon a second reading, began to trust its authenticity and replied “no” that he had not authorised any transfers.
He got an immediate response from the bank notifying him that his card had been compromised and would be temporarily blocked. The bank called 30 minutes later, informing him that the scammer had attempted three different transfers from his account.
“Had I ignored that message, I would have been really scammed,” the Victim told Crime Stoppers, adding, “I could have lost thousands.”
QR code scamming is on the rise and banks are remaining vigilant.
Different types of QR code scams
QR codes have become a convenient method for contactless payments by legitimate businesses. During the peak of the COVID-19 pandemic, their popularity surged because they allowed customers to make purchases without physically touching card readers, thus reducing the risk of spreading germs. Scammers may strategically place QR codes in public areas to steal money or credit card details. For instance, criminals have been known to post signs in parking lots, encouraging people to pay for parking by scanning a QR code. Unfortunately, these seemingly legitimate QR codes lead unsuspecting drivers to fraudulent websites.
People have reported receiving suspicious packages in the mail with a QR code either on or inside the mysterious package. This type of scam confuses people by delivering mail they never ordered from an unknown sender. Those who scan the QR code to get more information or look to return the order get taken to a scam website where they are prompted to enter their personal information.
Scammers may impersonate a charity or create a fake charity to steal money or victims credit card details. They may place QR codes on fake flyers or send them through a ‘quishing’ email, asking you to donate money to a cause.
How to spot a potential QR code scam
- Beware of compromised QR codes in public, such as car park meters, restaurants, and signs for free public Wi-Fi. Double check that a legitimate code hasn’t been tampered with, and there is not a sticker placed on top of another QR code.
- Look for typos and spelling mistakes in the URL address.
- Be cautious if asked to give access to your phone, computer, location, microphone, or any other features on your devices after scanning the QR code.
- Don’t share personal or financial details after scanning a QR code it is likely a scam.
If you’ve scanned a fake QR code, or think you have, here’s what you can do
- Change your passwords immediately and set up two-factor authentication on your accounts.
- Exit immediately if the code takes you to an unrelated site.
- Contact your bank if you entered your credit card information on a fraudulent website.
For more information
For more assistance, you can refer to the Scamwatch website.