Where was the last place you scanned a QR code: At the doctor\u2019s office, to learn more about a disease or medication? To get an in-store discount coupon while shopping? At your local restaurant, to see their menu? If it seems like those weird square codes are everywhere lately, you\u2019re right. They\u2019ve been widely used since the push toward touchless-everything in the early days of the COVID pandemic. <\/p>\n\n\n\n
Unfortunately, their popularity and ease of use also makes them catnip for criminals. You won\u2019t be surprised to know that QR code scams are on the rise (the FBI issued a warning about them<\/a> in 2022), and are increasingly dangerous. Let\u2019s take a look at some of the more common scams and how you can protect yourself against them. <\/p>\n\n\n\n QR short for \u201cquick response\u201dcodes have been around longer than you\u2019d think; they were originally developed for in-house use in industrial settings in order to speed processes and parts management. <\/p>\n\n\n\n It\u2019s essentially an upgrade and evolution of the older barcode technology<\/a>, which used the width and spacing of the bars to encode data. In a QR code, it\u2019s the arrangement and spacing of the square pixels that conveys information. QR codes have a lot<\/em> more potential arrangements than barcodes, which means they can hold a lot more data, as well. That data can be in the form of numbers, alphanumeric strings (text, URLs and the like), kanji characters or snippets of software code. <\/p>\n\n\n\n In practice, they can be used for all kinds of things, from paying for parking to providing the electronic equivalent of a business card. Singapore even uses them as a form of personal ID. It\u2019s exactly that versatility that makes them so useful to scammers. <\/p>\n\n\n\n If you watch renovation shows, you\u2019ll often hear the hosts comment scornfully about houses that were \u201cflipped\u201d on a budget, saying things like \u201cAll they did was slap on a fresh coat of paint.\u201d That\u2019s often how scammers work: they can<\/em> be hugely creative, but more usually they\u2019ll take an existing scam and give it a quick makeover to reflect whatever\u2019s going on in the popular imagination. <\/p>\n\n\n\n That\u2019s why student loan forgiveness gave rise to a sudden spate of student loan scams<\/a>, COVID relief spawned billions in benefits scams<\/a>, the increasing visibility of cryptocurrency led to Bitcoin scams<\/a> and so on. <\/p>\n\n\n\n Similarly, most QR code scams are basically just a new-looking way for scammers to roll out the \u201cgreatest hits\u201d that have already been successful in other forms. It\u2019s just a sneaky way to take another shot at your wallet using methods you might recognize if they showed up in a more familiar form. <\/p>\n\n\n\n So let\u2019s look at a representative sampling of these QR code scams. Some are slightly revamped versions of classic evergreen scams, while others explicitly exploit the unique characteristics of QR codes. <\/p>\n\n\n\n There are a lot of these, and they\u2019re effective for a couple of reasons. One, is that the QR code hides the underlying URL, so you can\u2019t tell if it\u2019s legitimate or takes you to a bogus website<\/a>. Another, is that scammers dip into their usual bag of tricks to give you a reason for scanning the code: The message may seem like it comes from your bank or a business you deal with regularly, or even a friend or coworker (whose account, in this case, has previously been compromised). <\/p>\n\n\n\n Another factor is simply that getting a QR code in an email or text message is still relatively rare, so even security-conscious people aren\u2019t conditioned to be suspicious of them in the way we would be with an emailed link or a dubious attachment. <\/p>\n\n\n\n These present themselves as a convenient way for users to install a new phone app, browser extension or what have you. Installing malware on your devices is the real goal, and it happens under cover of the installation you thought<\/em> you were doing. Some of these are advertised as doing jobs that juuuust happen to require access to your storage or your camera \u2014 or your input at the screen, which means you give them those permissions without them going to the time and trouble of hacking your device. <\/p>\n\n\n\n This is a variation on the phishing scam and the quick-install scam. The QR code still takes you to a bogus website, and may still attempt to fleece you out of your money or personal information, but the site\u2019s main purpose is to deliver what\u2019s called a \u201czero-click\u201d attack<\/a>: Once you\u2019ve visited the site, it can install its malware without your participation or knowledge. Nation-states have used this kind of attack to spy on citizens and journalists, but criminals use it to steal your information and (often) your money. <\/p>\n\n\n\n Several common QR code scams exploit the near-universal desire to be treated like a big shot. The come-on can be that you\u2019ll get access to premium features on a site, app or service (even when those don\u2019t really exist); or that you\u2019ll get premium services that do exist at a sharp discount from the usual price. Spoiler: You won\u2019t, but they\u2019ll get your money and maybe your information. <\/p>\n\n\n\n A variation on this theme targets the crypto-curious, offering inexperienced cryptocurrency investors expedited services or unusually good investment opportunities, if they\u2019ll just \u2026 scan this QR code \u2026<\/p>\n\n\n\n You\u2019ll encounter physical QR codes in many places in the real world, from restaurants (for the menu) to retail stores (for in-store offers and discounts) and even parking meters. Those are usually legitimate, but bold scammers can print their own bogus QR codes on stickers and position these over the real ones. It\u2019s the ultimate form of phishing, because you know<\/em> you\u2019re visiting a legitimate site. The end result is the same, though. <\/p>\n\n\n\n Scammers may also \u201cmash up\u201d old-fashioned mail scams with modern QR code technology, sending you a letter, business card, pamphlet, coupon or special order with a QR code printed in it. A particularly brazen version of this scam took place in San Francisco, where criminals placed bogus traffic tickets on windshields<\/a> with a QR code that led to a very good copy of the city\u2019s own ticket-payment site. <\/p>\n\n\n\n Finally, there are a number of QR code scams oriented around payments. Some businesses do legitimately use QR codes to make payment quick and easy, and of course those real-world codes are prime targets for the ol\u2019 \u201cput a sticker over it\u201d trick. Others ask you to scan a QR code so you can receive<\/em> a payment, which isn\u2019t how the system works (money only moves in one direction via QR code, and that\u2019s out of your account). <\/p>\n\n\n\n There\u2019s even a real-world version of this, where brazen scammers approach you in a plausible location \u2014 a parking area with QR codes for payment, or perhaps a subway or other train station with automated payment \u2014 and a sob story about only having cash, in a location that requires electronic payment. They\u2019ll ask you to scan a QR code to transfer money to them electronically, so they can pay, and give you the equivalent in cash \u201cright here, right now.\u201d Of course what you really give them is the ability to log in to your account and empty it. <\/p>\n\n\n\n While scammers may love the option of reusing their same old tactics every time a new opportunity comes along, it actually works in your favor. Once you understand that it\u2019s the same old schtick, you\u2019ll know that you can deal with it the same old way. One piece of advice we repeat frequently on this blog is \u201cdon\u2019t click the link,\u201d and we can now update that to include \u201cdon\u2019t scan the QR code!\u201d <\/p>\n\n\n\n That alone will protect you against most phishing scams, whatever the identity of the supposed sender. If you have any question of the code (or the situation it\u2019s supposed to address) being legitimate, you can go to the site or contact the company directly, rather than scanning the code. Protecting yourself against malicious URLs in QR codes is a bit harder, because there aren\u2019t a lot of ways to check one out without going to the actual site. You can<\/em> look at the URL in the address bar once it opens, and close it immediately if anything looks hinky. Unfortunately that still leaves you vulnerable to a zero-click exploit. <\/p>\n\n\n\n Not scanning the code at all is your best bet, of course. You might also consider a specialized QR code scanner from a reputable antivirus company, which can alert you to possibly-malicious sites before you load them. Just be sure that it\u2019s a reputable company, and a legitimate download, because QR code readers themselves may often be (or be infected with) malware.<\/p>\n\n\n\n Most of us are familiar with the rather cynical French observation that the more things change, the more they stay the same (\u201cplus \u00e7a change, plus c’est la m\u00eame chose<\/em>\u201d). That certainly applies to QR codes and their use by scammers. It\u2019s a new variation, but the same old tune. <\/p>\n\n\n\n That works in your favor, as an informed citizen of the online world (which you undoubtedly are, if you\u2019re reading this blog). At the end of the day, your online safety still comes down to maintaining a healthy degree of skepticism and a habit of thinking before<\/em> you click (or scan) anything. <\/p>\n\n\n\n These are learned behaviors, which means you get to have a lot of control over your own digital destiny. Helping keep you on top of these things (and providing the tools you need to do it) is Spokeo\u2019s side of the equation. You\u2019re welcome. <\/p>\n\n\n\n Sources:<\/strong><\/p>\n\n\n\n Where was the last place you scanned a QR code: At the doctor\u2019s office, to learn more about a disease or medication? To get an in-store discount coupon while shopping? …<\/p>\n","protected":false},"author":112,"featured_media":26702,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[614],"tags":[],"class_list":["post-26701","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-safety"],"yoast_head":"\nHow QR Codes Work<\/h2>\n\n\n\n
Scammers Don\u2019t Reinvent the Wheel (Much)<\/h2>\n\n\n\n
Common QR Code Scams<\/h2>\n\n\n\n
QR code phishing scams<\/h3>\n\n\n\n
\u201cQuick install\u201d QR code scams<\/h3>\n\n\n\n
QR code malware scams<\/h3>\n\n\n\n
Premium, \u201cVIP\u201d and \u201cinsider access\u201d QR code scams<\/h3>\n\n\n\n
Real–<\/strong>world QR code swapping<\/h3>\n\n\n\n
Physical QR code phishing scams<\/h3>\n\n\n\n
QR code payment scams<\/h3>\n\n\n\n
How to Protect Yourself From QR Code Scams<\/h2>\n\n\n\n
Other steps you can take include: <\/p>\n\n\n\n\n
The More Things Change \u2026<\/h2>\n\n\n\n
\n