QR codes have quickly become a ubiquitous tool in our everyday lives, offering a convenient way to access information or make payments with a simple scan. From restaurant menus to utility bills, these handy black-and-white squares are everywhere. However, as with any widespread technology, cybercriminals are finding ways to exploit it for malicious purposes.

What Is Quishing?

Quishing, a term derived from “QR code phishing”, is a type of cyberattack where fraudsters use malicious QR codes to trick people into visiting fake websites or downloading malware onto their devices. QR codes are designed to make life easier, but this simplicity is what makes them a prime target for cybercriminals. Since the user can’t see the URL hidden in the QR code until after scanning, quishing can be challenging to detect until it’s too late.

How Do Quishing Attacks Work?

Quishing attacks usually involve replacing legitimate QR codes with malicious ones. These fraudulent codes can appear in various places—on posters, at payment terminals, or even in emails and mailers. Once scanned, the QR code leads to a malicious website designed to steal personal information or trick users into downloading harmful software.

Real-World Examples: Parking Meter Scam

A common scam, as highlighted by the Better Business Bureau (BBB), involves cybercriminals placing fake QR codes on parking meters or payment terminals. Unknowing drivers, especially those without cash on hand, might scan the code to pay for parking, only to be directed to a fraudulent site that asks for their credit card details. The victim may not realize they’ve been scammed until days or weeks later when unexpected charges start appearing on their statement.

Another growing threat involves scammers impersonating legitimate utility companies or government agencies using fake QR codes. Victims receive what looks like official communication, urging them to scan the code to pay a bill. Instead of paying their bill, they are directed to an imposter site designed to harvest their financial information.

Malware and Phishing

In some cases, scanning a malicious QR code doesn’t just lead to a fake website — it can also trigger the download of malware onto your device. This opens the door for cybercriminals to steal your data, spy on your activities (spyware), or even lock you out of your system until you pay a ransom (ransomware). QR codes in phishing scams are particularly dangerous because the user might not realize their device has been compromised.

Who Is at Risk?

Anyone can fall victim to quishing, but certain groups are more at risk. For instance:

• Travelers: Tourists often rely on QR codes for navigation, payments, and accessing information in unfamiliar places.
• Mobile users: With the convenience of mobile payments and online transactions, QR codes make it easy to pay quickly — and easy to become a scam victim.
• Businesses and employees: Companies using QR codes for contactless services may unknowingly expose themselves or their customers to these attacks.

Signs of a Quishing Attack

Here are two warning signs:

1. Tampered QR codes: If a QR code appears damaged, misplaced, or out of place, it’s best to avoid scanning it. Cybercriminals often place their own QR stickers over legitimate ones.
2. Unexpected prompts: Be wary if you’re suddenly asked to enter personal details, financial information, or download software after scanning a code.

How to Protect Yourself from Quishing Scams

Be sure to follow these best practices:

• Verify with the source: If you encounter a QR code in a public space, such as a business or restaurant, it’s always a good idea to confirm with an employee before scanning. As the BBB suggests, pay particular attention to any signs that the QR code might have been tampered with.
• Avoid QR codes in unsolicited communications: Scammers are increasingly using fake QR codes in phishing emails or text messages. Never scan a code or click a link sent by an unknown sender.
• Use a QR Scanner with URL previews: Some QR code reader apps provide a preview of the URL before redirecting you to a website. This extra step can help you assess whether the link is trustworthy before proceeding.
• Update your security software: Keep your device’s security software up to date. This can help detect and block malicious downloads that may result from scanning a harmful QR code.
• Be cautious with online payments: When using QR codes for payments, especially in unfamiliar locations, verify that the payment terminal or website is legitimate before entering any financial information.

Protect Yourself with ScamCheck

With the increasing number and sophistication of scams, staying one step ahead is more crucial than ever. Unfortunately, antivirus software alone isn’t enough. Introducing the newly updated Trend Micro ScamCheck! Just look at how quickly and easily ScamCheck identified the above scam for one would-be victim:

Available for both Android and iOS, Trend Micro ScamCheck offers comprehensive protection from deceptive phishing scams, scam and spam text messages, deepfakes, and more:

• Scam Check: Instantly analyze emails, texts, URLs, screenshots, and phone numbers with our AI-powered scam detection technology. Stay secure and scam-free.
• SMS Filter & Call Block: Say goodbye to unwanted spam and scam calls and messages. Minimize daily disruptions and reinforce your defenses against phishing.
• Deepfake Scan: Detect deepfakes in real-time during video calls, alerting you if anyone is using AI face-swapping technology to alter their appearance.
• Web Guard: Surf the web safely, protected from malicious websites and annoying ads.

To download ScamCheck or to learn more, click the button below.

As always, we hope this article has been an interesting and/or useful read. If so, please do SHARE it with family and friends to help keep the online community secure and informed — and consider leaving a like or comment below. Here’s to a secure 2024!