How QR code scams work
Malicious users try to exploit the credibility associated with QR codes by embedding dangerous links in them, often disguised as legitimate websites or promo actions, so when you scan the code with your smartphone's camera or a special app, you are unknowingly directed to a fake website.
Common QR code fraud tactics
Fake payments: A QR code displayed at a gas station or parking meter may seem like a legitimate payment option. The scan could redirect you to a fake website that mimics a real payment processor and steals your card details.
Phishing or quishing attacks: A seemingly harmless QR code on a flyer or ad could lead you to a phishing site designed to look like a reliable login page (e.g. your bank or social media account). Once you enter your details, malicious users can steal your login information.
Dangerous software downloads: Scanning a QR code can activate a download prompt, disguised as a software update or free download. These downloads can be dangerous software that steals data, monitors your activity, or even takes control of your device.
It's important to look out for these signs:
Suspicious placement: Be wary of QR codes appearing in unexpected places, such as random stickers on poles or printed leaflets with poor grammar and spelling errors. Legitimate businesses usually use QR codes on their own branded products.
Unrealistically low prices: If a QR code promises something that sounds too good to be true, such as a gift of very high value or an exclusive discount, then it’s likely to be a scam.
Typos and grammatical errors: Phishing sites often have typos and grammatical errors – a red flag that indicates unsafe web pages.
Requests for unusual permissions: If scanning a QR code asks you to grant unnecessary permissions (e.g. access to your camera or microphone), it's important to be very cautious.
Staying safe in the QR Code era
By following the tips below, you can significantly reduce the risk of falling prey to QR code fraud.
Don't scan blindly: Before scanning a QR code, take some time to examine its source. Does it appear on a legitimate business's website or on a marketing product or service? If you're not sure, be wary and avoid scanning.
Type URLs: If something looks suspicious, instead of scanning a QR code, sometimes you can type the corresponding URL into your browser. This allows you to verify the legitimacy of the address before visiting the site.
Use a special QR Code Scanner app: While most smartphone cameras can scan QR codes, QR Code Scanner apps often offer additional security features. These features can include dangerous software detection, URL preview, and scam warnings.
What to do if you suspect a scam
If you suspect that you’ve scanned a dangerous QR code, take the following actions immediately:
Close the website tab: Don't interact with anything on the suspicious website. Close the browser window immediately.
Change passwords: If you entered personal information on the dangerous website, consider changing your passwords on your account.
Report the scam: Report the suspicious QR code to the platform where you found it (e.g. social media platform, website owner).
There are indeed many potential scams, but as long as you stay informed and are careful, you can safely reap the benefits of new technologies and all they have to offer.