QR code fraud: what it is and how to protect yourself

A QR code is a type of barcode that provides easy and quick access to any information (text, URL, checkout, transaction confirmation). It can be read by a regular smartphone or tablet. The full name sounds like Quick Response Code, which means “quick response”, “instant access”.

What is a QR code and where is it used?

QR codes were invented back in 1994, but they have been actively used only recently. The main reasons for the growth in popularity include the rapid development of mobile and Internet technologies, people’s desire to access information or conduct transactions (orders, payments) faster and easier, and the ongoing COVID-19 pandemic.

Today, QR codes can be found in almost all areas: cafes, restaurants, shops, car parks, equipment rental, transport, healthcare, finance, and advertising. According to Statista, over the past 2 years, the percentage of QR codes has increased by 26%, which indicates an active growth in the use of this technology.

Today, Asian and North American countries can be considered leaders in the use of QR codes. According to ExpressVPN, people in China are very active in using QR codes in everyday life: from queuing and scheduling dates to making transactions using Scan-to-Pay technology. European countries are slower to introduce QR codes, but the trend of active growth is still observed.

QR codes greatly simplify our lives and speed up many processes, but they also bring certain risks, such as fraud.

Types of fraud with QR codes

With the growing popularity of QR codes, hackers and fraudsters have begun to actively use this technology in their practice. The danger lies in the fact that “malicious” codes look no different from ordinary ones and are impossible to recognise at first glance. There is also no mechanism for verifying QR codes, and anyone can create them without much effort or skill.

QR codes can reveal a lot of information about their users, putting their privacy and personal data at great risk. By scanning a code and following a link, an unsuspecting person can reveal their location, browser, IP address, and browsing history to fraudsters. Attackers can easily gain access to personal data such as names, passwords, addresses, banking information, and browser cookies. All this information can be sold to third parties or used for personal gain.

To protect yourself from such cases, you need to understand how and where fraudsters can use “malicious” QR codes.

Fake QR codes in the service sector

Recently, QR codes have been increasingly used in the catering industry: cafes, bars, and restaurants. Many establishments began to actively implement QR codes in 2020 amid the COVID-19 pandemic, which allowed them to minimise human contact and continue to operate. As it turned out, QR codes also help to speed up the service process. Many restaurants use QR codes on their menus, websites, and when paying for orders. Fraudsters can fake and replace QR codes of establishments, thereby obtaining users’ personal data or redirecting them to phishing sites.

The same scheme can be used when using QR codes in shops, supermarkets, gyms, etc.

Risks of publicly accessible, public networks

Fraudsters often target public places due to easy access to a common network, such as free Wi-Fi in cafes. In this way, attackers can hack into the menus of establishments, replace information, and gain access to the personal data of connected users.

Free access to public Wi-Fi via a QR code can also be used for fraud. Cybercriminals often create fake Wi-Fi access points that unsuspecting users can connect to.

QR codes on product packaging

In recent years, QR codes on product packaging have become increasingly popular, replacing user manuals, product registration, and warranty cards. Brands and manufacturers use this technology to display information about their products more conveniently, collect feedback, or improve the overall quality of customer service. The active use of QR codes on packaging has also attracted the attention of fraudsters.

Attackers can send phishing emails to users under the guise of well-known brands containing familiar QR codes. There are cases when fraudsters have even sent physical parcels or gifts with fake QR codes to their victims, disguising them as products of original brands.

Financial transactions using QR codes

QR codes have made it possible to increase the speed and security of financial transactions through end-to-end encryption and PINless cash withdrawal functions. However, they have also become a target for fraudsters.

Criminals use QR codes to attack users’ bank accounts in several ways. One of the most common is to counterfeit the original QR codes used for payments in public places, such as car parks, petrol stations, vehicle rental outlets, and cafes.

The biggest danger of this method is not so much that an unsuspecting user has paid a small amount for parking to a fraudster but that the payment data is stored by the attacker, and unwanted transactions for large amounts can be made in the future.

Another common method of fraud using QR codes is cryptocurrency transactions. Attackers can lure users with “free giveaways” of cryptocurrencies or promise more favourable exchange rates. However, after scanning the QR code, users are redirected to malicious websites designed to collect data or steal their cryptocurrency wallet completely.

Social media has become the main channel for cryptocurrency fraud. Attackers often pose as official representatives of popular crypto exchanges or well-known crypto experts. They lure potential victims with all sorts of lucrative offers and often use QR codes. For example, in 2022, the US Federal Trade Commission found that 32% of all cryptocurrency fraud was committed on Instagram.

QR code in the field of medicine and healthcare

During the COVID-19 pandemic, QR codes played an important role in tracking the health status of patients and helped to monitor the spread of the virus more effectively.

After some time, QR codes have become an important tool for pharmaceutical companies, providing information about the production process, drug content, expiration dates, dosages, and safety measures.

Unfortunately, the healthcare sector is not immune to fraud either. Criminals use fake QR codes offering medical information to trick patients into giving out sensitive personal data.

How to use a QR code safely

QR codes are a handy tool that greatly simplifies many processes, so don’t be afraid to use them. In order not to fall for fraudsters’ tricks, you just need to follow a few simple rules. Here are perhaps the most basic of them:

1. Scan and follow QR code links only from trusted sources. Avoid QR codes placed on random leaflets, advertisements, banners, and stickers.

2. Check visually if the QR code looks like a fake one. It is a common practice for fraudsters to stick fake codes on top of the original ones. This is usually noticeable during visual inspection.

3. Check the URL. When scanning QR codes, most smartphones preview the URL where you are going to go. If the address is incorrect or clearly looks suspicious, it is better to refuse to visit it. Alternatively, you can use special online services to safely check QR codes, such as ZXing Decoder Online.

4. Update your devices regularly. As trite as it may sound, it really helps. Operating system and app developers pay special attention to security and vulnerabilities and release updates regularly. Keeping your OS and apps up-to-date and in the latest version will help protect you.

5. Take extra care when conducting transactions via QR codes. Avoid scanning QR codes when conducting financial transactions unless they are made through a trusted source, such as a reputable payment app or your bank’s app.

6. Deny access to unverified QR codes. QR codes that request additional access to personal information, such as contacts or location, should be treated with extreme caution. Allow access only to QR codes from trusted, verified sources.

7. Ignore third-party QR code apps. Modern smartphones can read QR codes without any additional third-party software. However, the App Store and Google Play offer a variety of QR code readers, some of which are even paid.