QR codes—those small black-and-white squares—have become a common tool in our daily lives, used for a variety of tasks ranging from mobile payments to quick access to websites. However, their simplicity and convenience have opened a backdoor for scammers: “Quishing” (a portmanteau of “QR” and “phishing”), or, more simply,the QR code scam.
How Does Quishing Work?
The principle is almost too “simple”: scammers generate malicious QR codes that, once scanned, redirect victims to fraudulent websites. These sites—often exact copies of legitimate ones—are designed to steal personal information, such as usernames, passwords, and credit card information. The process is insidious because it exploits the familiarity and trust we place in QR codes in our everyday lives.
The Rise of Quishing and Growing Awareness
2020: At the start of the COVID-19 pandemic, the use of QR codes skyrocketed as a contactless way to access restaurant menus and make payments, creating fertile ground for quishing.
2021: Authorities warned of a wave of phishing attacks targeting online banking users, with sophisticated campaigns impersonating major financial institutions.
2022: Launch of cybersecurity initiatives by government and nongovernmental organizations aimed at educating the public about the dangers of quishing and promoting the secure use of QR codes.
Some examples of QR code scams
- Parking Meter Scam
Scammers have placed QR code stickers on parking meters in several U.S. cities. When users scanned these codes to pay for parking, they were redirected to a fraudulent website that looked like the city’s official payment interface. The site asked victims to enter their credit card information, which was then stolen by the scammers.
- COVID-19 Pandemic
Posters and flyers featuring QR codes purportedly linked to important information about COVID-19 were distributed in public places and workplaces. These QR codes actually redirected users to malicious websites designed to steal personal data or install malware on victims’ devices.
- Fraudulent Restaurant Menu
Restaurants have reported that malicious QR codes were placed on their tables, replacing the real QR codes that link to digital menus. Customers who scanned these codes were redirected to websites asking for personal or credit card information, supposedly to access menus or special offers.
- Phishing Emails with QR Codes
In this variant, scammers send emails containing QR codes, claiming to be from banks or other financial institutions. Recipients are urged to scan the QR code to resolve an urgent account issue. However, the link leads to a fake online banking login page designed to steal victims’ usernames and passwords.
Highlighting the Extent of the Threat
Rise in Incidents: A recent study found that QR code phishing attempts increased by 300% between 2019 and 2022, a significant rise that coincides with the growing adoption of QR codes in many industries, including the restaurant, retail, and banking sectors.
Affected users: According to a 2023 report, about 1 in 5 smartphone users scanned a malicious QR code in the previous year, highlighting the scope of this fraud tactic.
Financial Losses: Losses resulting from QR code fraud reached an alarming peak of $50 million in the United States in 2022, illustrating the significant financial impact of these malicious activities.
The Importance of Increased Vigilance
Phishing serves as a reminder that, in the digital age, caution remains our best ally. By staying informed and vigilant, you can protect yourself against fraud attempts and navigate our connected world safely.
Conclusion and Best Practices
- Be cautious about the source of the QR code: Be wary of unsolicited QR codes or those from questionable sources, particularly those displayed in public spaces without a clear context or those received through unofficial channels.
- Check the destination URL: Before entering personal information, check the URL in your browser. Secure websites typically use the HTTPS protocol, and the address must match the entity it claims to represent.
- Use a secure QR code scanner: Some QR code scanner apps offer additional protection by analyzing the destination URL to detect potential scams.
- Keep your personal information private: Never enter your personal information, login credentials, or banking details on a website you accessed via a QR code, unless you are absolutely certain it is legitimate.
