QR Code Scam Tactics and How to Spot Them - Trivia That Protects You Just by Knowing It
The Incident of Fake QR Codes Stuck on Parking Meters
In 2022, an incident occurred in the U.S. state of Texas in which fake QR code stickers were stuck on parking lot meters. Scammers layered fake QR code stickers they had made on top of the real QR codes. Scanning one displayed a payment page that looked exactly like the real one, and entering credit card information handed it straight to the scammers.
This tactic is called "quishing" (Quishing = QR + Phishing), and damage has been reported around the world. Because a real QR code cannot be told apart from a fake one by appearance alone, QR codes are being abused as a new means of phishing scams.
In the Texas incident, the police issued a warning, calling on people to "pay parking fees with the official app or in cash." It is a lesson that the convenience of QR codes can become an entrance to scams just as it is.
Cases Where Restaurant Menu QR Codes Are Swapped
Since the COVID-19 pandemic, the style of placing QR codes on restaurant tables to display the menu has become common. There is a risk that these QR codes will be swapped for links to fake sites made by scammers.
The tactic is simple. All it takes is sticking a fake QR code sticker over the QR code placed on a restaurant table. Scanning it displays "You need to download an app to see the menu" and gets you to install an app containing malware. Or it displays "Please connect to Wi-Fi" and gets you to enter a password on a fake Wi-Fi connection page.
Restaurants have also started taking countermeasures. One method is to reduce the risk of stickers being pasted on top by "engraving" or "printing" the QR code directly into the table material instead of "sticking" it on the table. Some stores also write "Official URL: example.com" next to the QR code so that you can check whether the URL after scanning matches.
The Trap of QR Codes Printed on Email and Postal Mail
There is also a tactic of printing QR codes on paper postal mail and sending it out. "Redeliver your package from this QR code." "Tax refund procedures are here." "You have an unpaid electricity bill." QR codes are printed on mail disguised as being from public institutions or major companies, and scanning them leads you to fake sites.
What makes this tactic clever is that, unlike email phishing, it carries the sense of trust of "paper postal mail." It exploits the psychology of "it arrived on paper, so it must be real." In reality, it is fake mail that the scammers simply printed and posted.
The countermeasure is simple. Before scanning the QR code, check whether the mail is genuine. Call the sender's phone number directly, or access the official site yourself to check. Having the option of "not scanning the QR code" is the most reliable defense.
The Tactic of Swapping a Store's Payment QR Code
This is a tactic of swapping a store's payment QR code for a fake one so that the payment amount is sent to the scammer's account. Its characteristic is that the damage is hard to notice, because users send the money thinking it is a legitimate payment.
As a countermeasure, it is important to have the store confirm receipt of the payment after paying. Also, if something feels off, such as the plate with the QR code printed on it being unnaturally new or being fixed in place with tape, check with a staff member.
3 Points to Check Before Scanning
To protect yourself from QR code scams, make it a habit to check the following 3 things before scanning.
1. Is a sticker pasted over it?: Try lightly catching the edge of the QR code with your fingernail. If a sticker has been pasted on top, the edge will peel up. QR codes in public places (parking lots, bus stops, restaurants) in particular call for caution.
2. Check the URL after scanning: After scanning a QR code, do not open the link right away; check the URL that is displayed. Does it match the domain name of the official site? Is it an unfamiliar short URL? Has ".com" been changed to ".corn"? If anything about the URL feels off, do not open the link.
3. Stop and think when asked to enter personal data: If the QR code's link destination asks you to enter personal data such as a credit card number, a password, or your Individual Number (My Number), suspect the possibility of a scam. Legitimate services almost never ask for confidential information to be entered via a QR code.
What to Do If You Have Scanned One by Mistake
Even if you have read a suspicious code, damage is easier to avoid as long as you do not enter information on the page that appears. Do not hurry to follow the instructions; first close the page. If you have entered an ID, password, or card information, change that password right away and contact the card company and the services you use. Also check whether any charges or notifications you do not recognize have arrived. Noticing early and acting early leads to keeping the damage small. Rather than keeping it to yourself, consulting the appropriate contact point is also an important response.
QR Codes Are Two Sides of the Same Coin: "Convenient" and "Dangerous"
The greatest strength of QR codes is "the ease of jumping to the link destination just by scanning," but this is also, just as it is, their greatest weakness. When you type a URL by hand, you enter it while checking the string of characters with your eyes, so it is easy to notice a suspicious site. With a QR code, however, the link destination can be opened right after reading, so there is a danger of accessing a fake site without checking the URL.
That said, not using QR codes is not realistic. What matters is to have the habit of "QR codes are convenient, but always check the link destination." This is a basic of digital literacy, the same as checking the sender before clicking a link in an email.