Don’t Fall for the QR Code Scam

QR code scams, often called “quishing,” are a rapidly growing threat where criminals use fake QR codes to steal money and personal information. These codes can appear in emails, on physical signs, or in unsolicited packages. Scanning a fraudulent QR code can lead you to a fake website that steals your login credentials, or to a malicious site that downloads malware to your device. The best defense is to remain skeptical and never scan a QR code from an unknown or suspicious source.

Key Takeaways (Scam at a Glance)

• Deceptive Delivery: Scammers place fake QR codes in public places, send them in phishing emails (“quishing”), or include them in unsolicited packages.
• Data and Financial Theft: A malicious QR code can lead to a fake payment page, a site that steals your login credentials, or an automatic malware download.
• Evolving Tactics: Criminals are becoming more sophisticated, even using QR codes in a new variation of “brushing scams” to get victims to scan them.
• Simple Defense: The golden rule is to only scan QR codes you are 100% confident are legitimate, and to always verify the URL before entering any information.

The QR Code Scam: Your Guide to Scanning Safely

QR codes have become a part of our daily lives, from restaurant menus to digital payments. Their convenience is undeniable, but it has also created a new frontier for scammers. The “QR Code Scam”—a term that encompasses everything from fake parking meters to “quishing” emails—is a modern form of phishing that leverages our trust in this simple technology to steal money and data. This guide will walk you through how these scams work and, more importantly, how to keep your phone and your wallet safe.

How the Scam Works: A Step-by-Step Breakdown

The Lure: Placing the Fake Code

The scammer’s first step is to place a fake QR code where a real one would be expected. This could be a sticker over a legitimate QR code on a parking meter, a fake sign for a charity donation, or a QR code in a professional-looking phishing email.

The Attack: The Malicious Redirect

When you scan the fraudulent code, your phone’s camera reads the embedded link. Instead of taking you to a legitimate website, it redirects you to a malicious site. The scammer’s goal is to make this website look identical to a real one, such as your bank’s login page or a payment portal.

The Fraudulent Goal: Stealing Your Information

Once you’re on the fake website, you might be asked to enter your login credentials, credit card number, or other personal information. The site may even prompt you to “download an app” to complete a payment, which is actually malware designed to steal data from your phone.

This is a form of credential harvesting. The scammer’s goal is to get your login details for one site so they can try them on others, hoping you’ve reused your password. Always use a password manager to prevent this.

The Psychology: Why This Scam Is So Effective

This scam preys on our assumption of trust and our modern need for speed and convenience.

• Trust by Association: We see QR codes on a menu, in a magazine, or in a public space and assume they are legitimate. The scammer exploits this trust.
• The Power of Automation: QR codes remove the friction of typing a URL. This automated action bypasses our natural caution, as we often scan before we think.
• The Disguise: The fraudulent websites are often sophisticated, perfectly mimicking the branding and layout of the real thing, making them incredibly difficult to distinguish from a legitimate site. [Analogy: Think of a QR code like a car key. A real key gets you into your car. A malicious QR code is like a fake key that opens a stranger’s car door, which may have a bomb inside.]

Red Flags: 7 Telltale Signs of the QR Code Scam

1. A Sticker Over a Real Code. Always look for signs of tampering. If a QR code looks like a sticker placed on top of another one, don’t scan it.
2. Unsolicited Packages. The FBI has warned about a new variation of “brushing scams” where unsolicited packages contain QR codes. Never scan a code from a package you didn’t order.
3. Typos or Strange URLs. After scanning a QR code, always look at the URL that appears on your screen before clicking to proceed. A legitimate URL will be spelled correctly and be the one you expect.
4. Suspicious Emails or Texts. Be wary of “quishing” emails or texts that pressure you to scan a QR code for a refund, a prize, or to pay a bill.
5. A Request for Personal Data. A QR code should not require you to enter sensitive information just to view a menu or make a simple payment.
6. A Generic, Unbranded QR Code. Legitimate businesses often use branded QR codes. A generic, pixelated black-and-white code on a sign or flier should be treated with skepticism.
7. Unusual Payment Methods. The fake website may demand payment via unusual methods like cryptocurrency or gift cards, which is a major red flag.  The FBI’s El Paso Field Office warns consumers about how QR codes are being misused to steal money and data.

What to Do Immediately If You’re Targeted

If you believe you have scanned a malicious QR code, take these steps immediately:

1. Do Not Enter Any Information. If you are redirected to a website and it looks suspicious, close the browser immediately. Do not log in or provide any personal data.
2. Disconnect Your Device. If you’ve downloaded an app or suspect malware, disconnect your phone from the internet to stop any data from being transmitted.
3. Change Your Passwords. If you entered any login information on the fake site, change that password immediately on the real website.
4. Contact Your Bank. If you entered any financial information, contact your bank or credit card company to report the potential fraud.
5. Report the Scam. Report the fraudulent QR code to the FBI’s Internet Crime Complaint Center (IC3).

Prevention: How to Protect Yourself and Your Family

• Skepticism is Your Best Tool. The easiest way to avoid a QR code scam is to be skeptical. If you have any doubt about the source of a QR code, don’t scan it.
• Use App-Specific Scanners. Instead of your phone’s camera, use built-in scanners from trusted apps (like your bank’s app or a payment service) when possible.
• Inspect the URL. Make it a habit to check the URL displayed on your screen after scanning but before clicking “go.”
• Talk to Your Family. Make sure older family members and children are aware of this scam. Remind them not to scan codes from unexpected sources like unsolicited mail. Expert Insight: Many people believe a QR code will only take them to a website. But it can also trigger a phone call, send a text message, or even automatically download an app without your explicit permission if you’re not careful.