Think twice before scanning that QR code

Courtesy ParkHouston TNS

An arrow shows a phony QR code on a parking station in Houston in January. Cybersecurity experts say QR codes have created new opportunities for fraudsters.

Stateline.org

During the COVID-19 pandemic, people have become accustomed to using their smartphone cameras to scan small black-and-white square bar codes, allowing them instantly to do everything from access restaurant menus to pay bills.

Scanning a Quick Response, or QR code, is convenient and easy. And it is contactless, which can make people feel safer in public places such as restaurants, many of which substituted the codes for paper menus.

But cybersecurity experts say QR codes also created new opportunities for fraudsters, who can tamper with them and direct victims to malicious websites to steal their personal and financial information.

“During the pandemic, they looked at how people were engaging and ways to manipulate that,” said Angel Grant, who tracks QR code fraud as vice president of security at F5, a Seattle-based app security company. “Cybercriminals always look for disruption to cause disruption.”

One of the newest QR code scams has targeted drivers at pay-to-park kiosks in several large Texas cities.

The scammers slapped stickers with fake QR codes on the pay stations. Drivers who scanned them were directed to a website that asked them to enter their credit card or bank account information.

Just this month, another fake QR code scam targeting drivers popped up in Atlanta. Officials there reported that drivers were finding fake parking tickets with QR codes on their cars, directing them to a phony website. Real parking tickets in Atlanta don’t use QR codes.

And sham QR codes aren’t just showing up in parking-related scams. They’ve cropped up on billboards, online ads and in phishing emails, which are designed to trick people into divulging personal information.

Last month, the FBI issued an alert about cybercriminals tampering with QR codes to steal login and financial information. It said the codes not only can redirect payment using phony links but also can contain embedded malware that lets a criminal gain access to a victim’s mobile device and financial and personal information.

“It is important to practice caution when entering financial information as well as providing payment through a site navigated to through a QR code,” the FBI warned. “Law enforcement cannot guarantee the recovery of lost funds after transfer.”

While there is no data on how frequently QR code fraud occurs nationwide, the Better Business Bureau has been seeing a spike in reports about it in the past year. In July, it issued an alert, saying that people may get an email, a direct message on social media, a text message or a piece of mail with a fake QR code. Scanning it can send them to a fraudulent website or automatically launch a payment app.

Among the scams are those dealing with student loans and cryptocurrency.

“Scammers hope you will scan the code right away without taking a closer look,” the organization said.

Grant, of the app security company, said she started noticing a surge in QR code scams during the pandemic.

“We saw a huge increase of people using QR codes because of the convenience and the contactless experience,” she said.