Quick Response (QR) codes are a convenient tool for accessing information quickly, making payments, and engaging with digital services. However, as with any technology, criminals have found ways to exploit them. Recent media reports have highlighted the growing trend of scammers placing their own QR codes over legitimate ones in public spaces. These rogue codes redirect unsuspecting users to fake websites designed to steal personal information, financial details, or install malware on devices.
Where These Scams Occur
While QR code frauds can happen anywhere, they are particularly common in places where people expect to scan codes as part of routine tasks. Some high-risk areas include:
- Public car parks – Scammers stick fake QR codes over legitimate ones used for parking payments, tricking users into entering their payment details into fraudulent websites.
- Cafes and restaurants – Many establishments use QR codes for menu browsing or contactless payment. A swapped code could lead to a fake payment portal.
- Bus stops or public transport hubs – QR codes that direct passengers to timetables or ticketing systems could be manipulated to capture personal information.
- Tourist attractions – Scammers may replace codes at tourist hotspots that typically lead to information about exhibits or attractions, instead diverting users to phishing websites.
Risks Involved
- Phishing and malware – Scanning a fake QR code may redirect users to a website that looks legitimate but is designed to steal personal information like passwords or payment details. Some links may even trigger malware downloads onto a user’s device.
- Financial loss – Fake QR codes that ask for payment information can result in direct financial loss if users unknowingly enter their credit card details into fraudulent payment platforms.
- Compromised data – Beyond financial losses, scammers can capture sensitive data that can be used for identity theft or sold on the dark web.
Precautions to Take
- Visually inspect the QR code – If a QR code appears to be stuck on, out of place, or poorly printed, avoid scanning it. Scammers often slap fake codes on top of legitimate ones, so any sign of tampering should be a red flag.
- Use a QR scanner with security features – Certain QR scanning apps provide security features, such as previewing the URL before proceeding. This allows you to verify whether the site is legitimate before clicking any links.
- Stick to trusted sources – When possible, manually enter URLs or use official apps for payment systems or services. If you have any doubt about a QR code, look for alternative ways to access the service.
- Check the website URL – After scanning a QR code, always double-check the URL to ensure it is legitimate. Scammers often websites that look almost identical to the real ones but have minor changes in the web address. Examples include using foreign characters that look almost identical to their English equivalent.
- Use a secure network – Avoid scanning QR codes and entering personal information when connected to public Wi-Fi networks, as these are often less secure and can be monitored by hackers.
- Keep devices updated – Ensure that your mobile device’s operating system and security software are up-to-date. These updates often include patches that protect against malware and phishing attempts.
- Report suspicious activity – If you encounter a suspicious QR code, inform the business or venue staff. They can take steps to remove it and protect others from falling victim to the fraud.
QR codes are a convenient and widely used tool, but as with any digital technology, criminals can exploit them. By remaining vigilant and following the simple precautions listed above, you can minimise the risks of scanning a QR code in public places. If something feels off, it is always better to take a few extra seconds to double-check than to risk falling prey to a fraud.
