What Exactly is a QR Code Scam?

A QR Code, or Quick Response Code, is a type of two-dimensional barcode that can store information and be easily scanned using a smartphone camera. QR codes are great for quickly accessing information, but they have also become a tool for cybercriminals. This has led to the rise of fake QR Code scams. These scams exploit the ease and popularity of QR codes to carry out various fraudulent activities. Essentially, a QR Code scam involves creating a malicious code that, when scanned, directs the victim to a phishing website, downloads malware, or initiates an unauthorised payment.

Scammers typically trick victims into scanning QR Codes under false pretences. For example, a scammer might cover a legitimate QR Code with a fake one on a flyer or advertisement. When someone scans the fake code, they could be redirected to a fraudulent site asking for personal details or login information. With this information in hand, scammers can use it for identity theft or unauthorised financial transactions. Some QR Code scams may download malware onto your device, which can steal your personal information, or even lock your device in a ransomware attack.

In this blog, we cover the common types of QR code scams, how to differentiate between fake QR codes and legitimate ones, and how to protect yourself from these scams.

Common Types of Fake QR Code Scams

Phishing QR Codes (Quishing)

Phishing QR codes are a new trick used by cybercriminals to steal personal information like login details or financial information. This scam is simple but very effective. A fake QR code is created by scammers to mimic authentic sources. If you were to scan one of these codes, you would be redirected to a fake website that resembles a legitimate one. These sites then ask you to enter sensitive information, which the attackers collect. The main reason why phishing code attacks are so effective is because QR codes seem harmless. Many people don’t realise they’re at risk, making this scam especially dangerous.

Malware QR Codes

Malware QR Code scams are another new but common exploit that tricks users into scanning the code, resulting in malware being installed on their device. Once the malware is installed, criminals can access personal information, and banking details, and even control the device.

Real-Life Examples of QR Code Scams

QR Code Scams in Public Spaces

Fake QR code scams are increasingly common in public spaces. From shopping centres to train stations, these codes could be anywhere. These scams often involve QR codes placed physically in public spaces, such as on posters or flyers. They might pretend to offer deals, surveys, or even safety information. These tactics take advantage of the convenience and novelty of QR codes, catching people off guard and increasing the likelihood of scamming success.

Fraudulent QR Codes in Emails and Messages

Another common tactic used by scammers is sending fraudulent QR codes via email or messages. They might appear to come from trusted sources like banks or online shops, offering special deals. But when scanned, these QR codes can trick you into giving away your data. It's important to check the source of the QR codes before scanning to stay safe from these cyber-attacks.

Fake QR Codes Found on Websites

Scammers use QR codes on websites to lure people in with promises of exclusive content or discounts. It's crucial to be cautious of QR codes on websites and only scan ones from trusted sources to keep your data and devices safe.

How to Spot Fake QR Codes

• Poorly designed QR codes: If a QR code looks blurry, pixelated, or hard to scan, it’s probably a scam. It's a good idea to avoid scanning poorly designed QR codes to stay safe from scams.
• Suspicious Content: One of the most telling signs of a fake QR code is suspicious content. If a QR code directs you to a website that prompts you to enter personal information, download unknown files, or make a payment, it is likely a scam.
• Check the QR code’s origin: Check where the QR code came from. If it's from an email, make sure the sender is legit. For physical QR codes, think about why they're there and how they're placed. Also, watch for signs of tampering, like a sticker covering the original code, which could mean fraud.
• QR code scanners: Use QR code scanners that show you the URL before opening them in a browser. This extra step helps you detect and steer clear of sketchy links. Most smartphone cameras now have this feature built-in, giving you a vital safeguard against accessing harmful content without realising it.

How to Protect Yourself from QR Code Scams

Verifying the Source of a QR Code

One key step to protecting yourself is checking the source of a QR code before scanning it. Confirming it's from a trusted source can greatly reduce the risk of being scammed.

Another way to verify a QR code's source is to look for any strange markings on the code itself. Fraudulent codes might have altered info or extra images, signalling they're fake. Pay close attention to logos or branding on the QR code, as scammers might copy legitimate companies to trick victims.

You can also research the website or company linked to the QR code. Visiting the company's official website or doing a quick internet search can confirm if the QR code is linked to a legitimate business or organisation.

Never Input Personal Information

One important rule to keep in mind when scanning codes is to never give out your personal information. By not entering any personal data, you lower the chances of becoming a target for these deceptive tactics.

Avoid Financial Transactions via Unknown QR Codes

Avoid making financial transactions through unfamiliar QR codes. These codes might lead to fake websites or apps that steal your personal or banking info. Only scan QR codes from sources you trust, like reputable businesses or official sites.

Also, make sure to keep your smartphone's security software up to date to prevent malware or viruses from getting in through QR codes. Being aware of QR code risks helps you avoid scams and protect your finances.