Businesses use Quick Response (QR) codes to provide a variety of services for their customers, such as locating apps for ordering a product and tracking shipments. They aren’t human readable, which allows scammers to easily embed malicious links in QR codes. This type of scam is becoming more common as the use of QR codes increases, according to the Better Business Bureau (BBB).
A QR code is a two-dimensional barcode that the Japanese automotive manufacturer Denso Wave invented in 1994. It’s a machine-readable label that contains information about a specific product such as identification, location and a pointer to an application or website. A QR code can use any of four encoding modes, including alphanumeric, binary, numeric and kanji. They may also use extensions for these modes.
Scam Examples
QR scams differ greatly in their execution, but they generally rely on the victim scanning the code without thinking about what they’re doing. In particular, scammers hope that the victim won’t consider the QR’s source before scanning it.
The most common QR scam of this type involves distributing content that contains a QR code, which could be a piece of mail, flyer, text message or social media post. The code typically opens a web page when victims scan the QR code with their camera. This website is usually a phishing website controlled by the scammer that resembles a legitimate website. In this case, the website prompts the victim for personal information, especially login credentials.
For example, a victim may receive a letter claiming to offer a consolidation for student loans. The letter also contains a QR code that appears to link to an official government website that deals with student loans. This scam can be highly effective when it’s sent to someone who is currently paying off a student loan. Another approach is to use QR codes to launch a payment app or follow a social media account that the scammer controls.
Scammers can also embed a Bitcoin address in QR codes, which is a common form of cryptocurrency scam. In this scam, consumers may receive a message on a social media platform purporting to be from a forex trader offering an investment opportunity. The victim is expected to pay a withdrawal fee through a Bitcoin machine and send it to the provided QR code. Next, the victim receives an email requesting a transfer fee, which should tell the victim that the message is a scam.
Prevention
The most effective method of avoiding scams involving QR codes is to confirm that the code came from the party you think it did. Contact that party directly and ask if they sent the QR code before scanning it. You can also make QR scanning more secure by adding an app. Antivirus (AV) companies frequently offer apps that check a QR code before opening it, allowing it to detect links that perform malicious actions such as forced downloads and phishing scams.
Look for signs of tampering in advertising materials. Scammers may alter legitimate business ads by placing a sticker with their QR code over the ad’s original QR code. Use extreme caution when a QR code uses a TinyURL, which is an abbreviation of the complete URL. In this case, you don’t know where the URL will direct you, so it could be a scam.
QR code flickr photo by Christiaan Colen shared under a Creative Commons (BY-SA) license
