Beware of QR Code Scams

Quick Response codes, more commonly known by their abbreviation as QR codes, allow users to scan an image with their phone’s camera and jump directly to a site. Lately, Blinn College District has seen an increase in scam emails with QR codes attached. In addition, other QR code scams continue proliferating in public spaces. Here’s what to know, what to watch out for, and how to avoid them.

Scam QR codes can lead to the following issues on your device when you scan them:

• Malicious sites can infect a phone with malware when the browser visits the URL embedded in a code. The malware may try to grab sensitive data stored on your phone, including passwords, or monitor inputs.
• The QR codes can lead to fake retail, credit card or banking sites, recording login data and/or stealing money.
• The codes may prompt users to install apps that bypass the Google and Apple stores. The rogue apps then steal data, redirect computing resources on the phone, or compromise privacy.

Delivery methods:

• Email
  Scam emails with QR codes attached can sometimes bypass email filters by not placing keywords in the text that trigger junk mail rules. The QR codes often point to malicious sites.
• Online ads
  QR codes do not have to be printed in order to be scanned. Your phone can scan them directly off a computer monitor. Thus, some crooks have resorted to placing QR codes in online ads. Again, because they do not use text, keyword scanners may miss the fact these codes lead to malicious sites.
• Social media
  Hacked social media accounts sometimes post QR codes that lead to password-stealing sites. Because the post is from a friend, relative or acquaintance, typical suspicions might be allayed, leading unsuspecting users to scan the link.
• Snail mail and unexpected packages
  Some scammers have used the post office to deliver regular old snail mail to customers with QR codes printed on labels or on documents inside envelopes or on postcards. Surveys or sweepstakes might be the excuse offered for scanning the code. Packages delivered through the post office or private delivery services may have codes for further instructions or with directions like “Scan here if you did not order this.”
• Public stickers and posters
  The Cities of San Antonio and Austin have experienced scam stickers placed on parking meters. Unsuspecting drivers thought they were using a touchless, cashless pay system but were in fact going to a skimming site. Scam QR codes have also been printed on stickers appearing elsewhere in public such as restaurant menus and gas pumps. Sometimes they are on posters or just printed out on typing paper. Business proprietors may not notice the stickers right away, allowing ample time and opportunities to mislead the public.

Ways to protect yourself from scam QR codes:

• Help keep your phone secure by ensuring you have the latest updates installed. Some malicious sites use known vulnerabilities in older operating systems.
• Typical email precautions apply with those containing QR codes. Don’t trust unsolicited emails from people you don’t know.
• There are few legitimate reasons to include QR codes in emails. You are already online, there is no need to take your phone and go online somewhere else with another device by scanning a code off the computer screen. Same goes for online ads. Treat all QR codes in online ads and emails with suspicion until proven otherwise. Remember, they might be trying to bypass typical junk ad and email filters by using QR codes.
• Avoid installing aftermarket QR code scanners on your phone. Instead, use the one that came built-in with your device. Rogue scanners could send your phone to malicious sites.
• Check the URL before clicking. Your phone will typically show at least part of the URL onscreen. You can get an idea beforehand if the code is taking your phone’s browser to where it says it is.
• Is the QR code on a sticker? If you see one on a sticker on a restaurant menu or parking meter or somewhere else in public, consider it suspicious. Likewise, printed sheets of paper.