QR codes are everywhere these days. People use them to open websites, download apps, collect loyalty points, make payments and transfer money. This is very convenient for people, but of course there is a catch: Cybercriminals also try to cash in and have already devised numerous tricks using QR codes.
A QR code created by cybercriminals may lead to a phishing site that looks like the login page of a social network or online bank. Therefore, we recommend always checking links before tapping or clicking them. A QR code does not offer this possibility and attackers often use shortened links, which makes it even more difficult to recognise a fake link when the smartphone asks for confirmation. Similar tricks can mislead users, causing them to download malware instead of the intended other app.
This variety of possibilities makes QR codes ideal for manipulation and distribution via several channels including social media. A very good example was explained in an earlier blog article by my colleague Karsten Hahn, about QR codes advertising pirated software to lure people into downloading a malicious Chrome extension instead of the expected software.
And there is much more how QR codes can be used for fraud.
QR codes are basically just a slightly more sophisticated version of barcodes. Herein lies the rub: Such codes are not human-readable, so there is no way to verify or otherwise pre-check what data is contained in them and what might happen when you scan them. So we have to rely on the integrity and good intentions of the code creators. The system can be exploited in many ways.
Many of the current smartphones have a built-in QR scanner, and everyone can download an app that reads all QR codes. To scan a QR code, the user simply opens the scanner app and points the phone's camera at the code. In most cases, the smartphone then gives a notification to go to a certain website or to download an app.
For example, you might find such a code on a wall of museum, and scanning it with the museum's official app might initiate a guided tour. Besides linking to a website or an audio file, a QR code can also be printed on a business card and contain a digital contact file with names, phone numbers and email addresses. That way, you can immediately add the contact details from a business card to your phone contacts without typing them in. Other possibilities include sharing your location with an app, send a text message, add an event to your calendar, or setting up a preferred Wi-Fi network with login details for automatic connection. It is even possible to cram entire programs into a QR code, although admittedly this is more of a niche application that has yet to see widespread use.
Attackers who want to do harm with a QR code first need to persuade you to scan it. Two tactics dominate here:
The possibilities are almost endless. QR codes are also commonly found on utility bills, pamphlets, office signs, inside Powerpoint presentations and pretty much anywhere you can expect to find information or instructions.
The good old coin-operated parking meter, is also seeing a transition to modern times. In addition to various coinage, you can often also use an app to pay for your parking fee. Which is very convenient, because we all have had a parking meter or vending machine of some sort repeatedly reject our coins for no apparent reason.
You open the app, enter the code of your parking meter and you then can pay via the app. This is convenient enough – but criminals have taken this a step further. Earlier this year, reports emerged about fraudulent stickers appearing on a few parking meters in cities in the USA. They were designed to look like you could just scan the code and pay for your parking fee that way – which is even more convenient. The catch is: the QR code was never issued by the municipality as a way to pay. So in a worst case scenario, you might not only lose the money you assumed you paid for your parking fee, but also might face the consequences of having handed payment data such as your credit card number to the criminals. And as if all this was not enough already, you even might end up having your car towed.
QR codes are commonplace enough for many things, so on the face of it, having them do things like payment makes sense. But often enough, QR codes are NOT chosen for this purpose by public administration for this exact reason: They are too easily faked. So informing yourself of such modalities ahead of time is a good idea.
From the criminals’ perspective this is a relatively low-risk scheme. Having high quality, professional looking stickers printed is cheap and easy enough and therefore the material invest is minimal. There is strength in numbers. Criminals pretty much break even after the first payment comes in through a fake QR code, and each subsequent payment is a net win, especially if you can snarfle credit card data on top of the payments you collect. Scale this up to an operation involving a few dozen parking meters in a reasonably affluent area and you get the idea.
In the Netherlands, there were cases reported of people convincing strangers in the street to scan QR codes in order to transfer a small amount of money. This might be a parking fee, a ticket for public transport or anything else that involves helping a stranger out of a minor pinch. Going back to our earlier example, someone might claim to have tried to pay their parking fee using coins but the parking meter rejected them. And for some reason they cannot make the payment using the official app. They then ask a stranger to help them out using - you guessed it – a QR code they show to their victim and ask them to scan it. The code supposedly sends the “person in need” a small amount of money for an online payment of said parking ticket (alternatively they might claim that they pay the parking fee directly via the code), and our “good Samaritan” receives the owed amount of, say 2 Euros, right then and there, in cash. They might seem in a hurry to get somewhere important and say things like "Please, the machine is broken and will not accept any coins and I really need to be somewhere - could you scan this code and make the payment for me? That would help me so much - here you go, I give you the money back right here and right now!" But in reality, as soon as the payment data is entered, it lands in the hands of the criminals.
If your money is involved or your bank, call your bank immediately to have your account temporarily frozen. Furthermore, it is always wise to report it to the police. It will not always be easy to find out who the perpetrators are, as these criminals often do everything they can to remain anonymous. However, it is important to report the crime to the police, because this way they can get a better idea of the scale of the problem.
If you are approached in this way on a site or app, always report the account in question. This way, the website can block the account and prevent others from becoming victims too.
QR codes were once developed for our convenience sometimes but you should always think twice if you are using them!
Parking meter photo by Braeson Holland / Pexels
"Help" photo by MART PRODUCTION/ Pexels