Even though they’ve been around since 1994, quick-response, or QR, codes have surged in popularity during the past decade. Two notable developments contributed to the ubiquity of these data-filled images:
- In 2017, Apple and Google introduced QR code scanning as a built-in feature on their smartphone cameras.
- During the pandemic, QR codes offered a contactless way to accept payment and access menus.
Today, organizations use QR codes for diverse applications, from accessing event tickets or patient information to viewing websites or downloading coupons and special offers. Not surprisingly, the widespread use of this technology has prompted criminals to leverage the familiar squares in scams.
The Rise of Quishing, or QR Code Phishing
Since at least 2022, the FBI has received complaints from individuals who have fallen victim to cryptocurrency-related fraud, which typically begins with the use of QR codes. Known as quishing, or QR code phishing, such scams have become more common with QR codes appearing everywhere, even TV commercials.
In quishing, scammers often attempt to manipulate people into sharing their personally identifiable information (PII), credit card information, or even access to their phones, allowing criminals to download malware.
Have you ever scanned a QR code that led to a website that had nothing to do with what you were looking for? Scammers even cover valid QR codes with fake ones in high-traffic areas, such as gas stations, storefronts, parking meters, etc. The codes appear to link to legitimate pages—but don’t.
I almost fell victim to quishing while paying for parking in another state. After scanning a QR code, I found myself navigating a payment portal for a fitness website. Needless to say, this was not the outcome I had envisioned.
How to Avoid Quishing Scams
The following tips will help you avoid getting caught up in a QR code scam:
- Don’t scan random QR codes. If you’re not sure about the source, don’t scan the QR code. It’s best to err on the side of caution and stay away from the easy scanning options. Type the address of the site you want to visit. Scammers can use the QR code to send you to a website that automatically downloads malicious software onto your mobile device.
- Use a QR scanner. If you do scan a QR code, use a QR code scanner app like Google Lens or TrendMicro’s QR Code Scanner, which offers additional security features, such as blocking dangerous websites. When the website opens, check the URL immediately. If it isn’t what you expected, leave.
- Don’t log in. Be suspicious if a QR code sends you to a website that asks for a password or login info.
- Check the source. Do not scan QR codes received in text messages or emails unless you know for sure they are legitimate. Don’t forget—known senders can be spoofed.
- Do not provide payment information. Protect your data, and don’t provide credit card or banking information on a site you reached by a QR code.
