Think twice before scanning QR codes — experts say they could link to scams
During the COVID-19 pandemic, people have become accustomed to using their smartphone cameras to scan small black-andwhite square bar codes, allowing them instantly to do everything from access restaurant menus to pay bills.
Scanning a Quick Response, or QR code, is convenient and easy. And it is contactless, which can make people feel safer in public places such as restaurants, many of which substituted the codes for paper menus.
But cybersecurity experts say QR codes also created new opportunities for fraudsters, who can tamper with them and direct victims to malicious websites to steal their personal and financial information.
“During the pandemic, they looked at how people were engaging and ways to manipulate that,” said Angel Grant, who tracks QR code fraud as vice president of security at F5, a Seattlebased app security company. “Cybercriminals always look for disruption to cause disruption.”
One of the newest QR code scams has targeted drivers at pay-to-park kiosks in several large Texas cities.
The scammers slapped stickers with fake QR codes on the pay stations. Drivers who scanned them were directed to a website that asked them to enter their credit card or bank account information.
Just this month, another fake QR code scam targeting drivers popped up in Atlanta. Officials there reported that drivers were finding fake parking tickets with QR codes on their cars, directing them to a phony website. Real parking tickets in Atlanta don’t use QR codes.
And sham QR codes aren’t just showing up in parking-related scams. They’ve cropped up on billboards, online ads and in phishing emails, which are designed to trick people into divulging personal information.
Last month, the FBI issued an alert about cybercriminals tampering with QR codes to steal login and financial information. It said the codes not only can redirect payment using phony links but also can contain embedded malware that lets a criminal gain access to a victim’s mobile device and financial and personal information.
“It is important to practice caution when entering financial information as well as providing payment through a site navigated to through a QR code,” the FBI warned. “Law enforcement cannot guarantee the recovery of lost funds after transfer.”
While there is no data on how frequently QR code fraud occurs nationwide, the Better Business Bureau has been seeing a spike in reports about it in the past year.