Think twice before you scan
Those clusters of black pixels we got to know during the COVID-19 pandemic have become just about commonplace today. They are everywhere – restaurants, cafes, bars, and in just about every advertisement. But when you’re focusing on capturing the QR code with your camera, how many times have you stopped and wondered if what you’re scanning is legitimate?
If you’re like most people, probably never.
That is why hackers have realized that tampering with QR codes to gain access to your data is the perfect phishing method. After all, the best phishing methods are the ones that take advantage of the things we do habitually, without thinking or questioning.
So how do scammers tamper with QR codes? How can you discern between legitimate QR codes and malicious ones? Let’s dive deeper into how QR scamming works and how you can protect your personal information.
How do hackers use QR codes to scam?
The most common form of tampering is placing a malicious QR sticker over legitimate ones. This is especially popular for car parking meters, restaurants, and bars. Other popular methods include creating advertisements that appear legitimate and placing QR codes on them.
The thing to note is that people trust QR codes and are more skeptical about links they receive from text messages or emails. This is because with QR codes you can't see the URL and check for spelling mistakes or other signs of malicious links.
Scam examples closer to home
A Victorian individual unknowingly scanned a fake QR code during a social gathering. He believed he was scanning a code for the restaurant menu, however, he did not realize a sticker had been placed above the legitimate QR code. As he had not been to the restaurant before, he did not detect that the site they were visiting was fake, and he proceeded to fill in his financial and personal information.
In just one minute the victim received a text message from his bank asking him if he had authorized the transfer of a nominal amount of money. At first glance, he believed this message to be a scam until he received a second message from the same number seconds later. This time the victim texted back that he had not authorized a bank transfer. This was met by an immediate notification from his bank saying that his card had been compromised and would be temporarily blocked. The bank called half an hour later informing him the scammer had attempted three different transfers from his account.
“Had I ignored that message, I would have been scammed,” the victim told Crime Stoppers. “I could have lost thousands.”
Hackers have been known to tamper with some of Australia’s most trusted companies, such as Medicare, the ATO, My Gov and other sites that we trust.
How to spot a malicious QR code
QR codes should be treated with the same level of precaution as any link you receive from a suspicious email. While we strongly advise not to scan public QR codes in general, there are some tips for identifying malicious QR codes:
- Watch out for tampered QR codes in public places like parking meters and restaurants.
- Be cautious if asked to give access to your phone, computer, location microphone or any other features on your devices after scanning the QR code.
- If you are asked to share personal or financial details after scanning a QR code, it is likely a scam.
- Look for typos in the URL address.
Don't let your business fall behind
Falling behind means leaving your business unprotected
This article highlights that as technology continues to advance, so do the methods of cybercriminals. Therefore your business must stay on the pulse when it comes to cybersecurity software and technology - but you don’t have to navigate this alone.
At Dynamic Business Technologies we are passionate about providing innovative IT solutions with cutting-edge technology. This is particularly true for equipping businesses with the cybersecurity measures needed to protect their employees, clients, and partners. Let us look after the tech so you can focus on what you do best.
Next:
The cost of letting your cybersecurity fall behind
The cost of letting your cybersecurity fall behind