QR codes: Think before you scan

QR Code Phishing is a type of cyber scam where criminals use QR codes to trick people into giving up their sensitive information.

Quick Response (QR) codes have become a useful part of everyday life, allowing people to use their smartphone or device with a camera a quick and convenient way to access information with a scan.

But with all things in the cyber landscape, there is risk involved. Cyber criminals can now use a fraudulent QR code that, when scanned, will direct users to a fake website designed to steal personal or payment details or will prompt the user to download a fake app containing malware that steals this data.

Fraudulent QR codes can appear in emails, printed materials or across digital platforms and are becoming a common tool of cyber criminals. They are taking advantage of the ease and convenience that people have come to rely upon and trust when using QR codes.

QR code phishing in the wild 

A recent example of a QR code phishing scam affecting New Zealanders appeared in Christchurch. Reports were made of fraudulent QR codes being attached to public and private parking meters around the Christchurch area.

Once attached to the meters, scammers then vandalised the meter’s screen with permanent marker, deceiving unknowing customers into thinking the QR code was necessary to pay for their parking. The suspicious QR codes led to a fraudulent website that steals customers’ payment details. Christchurch City Council was forced to put out a notification warning customers of the stickers after parking wardens noticed them on parking meters.  

Fake NZ Post QR codes are another growing cyber fraud tactic used by scammers. Customers may receive an email claiming their parcel cannot be delivered due to an incorrect address or unpaid customs fees. The email will prompt customers to scan a QR code included to sort out the issue, only to be sent to a fraudulent website that mimics the official NZ Post tracking portal in the hope they will enter their personal or payment details.

The increased use of QR codes online as well as their appearance in places such as parking meters, restaurants, public Wi-Fi networks, and retailers means that people need to ensure they are aware and vigilant when interacting with them in order to keep themselves and their data protected.

Protect yourself from QR phishing

There are a number of practices individuals and organisations can take to reduce the risk of being affected by a QR phishing attack:

• Check the web address of the page displayed after scanning a QR code. If it looks suspicious or unusual, do not interact with it or enter any of your details.
• Exercise caution when scanning QR codes, particularly those that appear unexpectedly or look to have been recently attached or placed over existing codes.
• Be cautious of QR codes that are associated with time-sensitive requests.
• Use official app stores to download applications. If a QR code prompts you to download an app, back out and search for the app on the official app store.  
• Promote awareness among employees, friends and family about the potential risks related to QR code misuse.