Social Engineering

Social engineering is an attack method that steals confidential information by exploiting not technical vulnerabilities but human psychology (trust, fear, curiosity, urgency). It includes phishing emails, impersonation calls, fake technical support, entry by following someone in (tailgating), and so on. Even the most advanced security system is breached if a human is deceived.

QR codes are being abused as a new vector for social engineering. Because a social sense of trust has formed that "scanning a QR code gets you useful information," users tend to scan QR codes without doubting their safety. Attackers exploit this trust with tactics such as sticking fake stickers over legitimate QR codes, printing QR codes on fake parking violation notices, and placing fake QR codes for Wi-Fi connection in public places.

A particularly clever tactic is one that creates a sense of urgency. A message such as "Your account is being used without authorization. Scan this QR code now to check" stirs up fear and urgency and dulls the user's judgment. Even a QR code that would look suspicious on calm reflection gets scanned in a state of panic.

The basic countermeasure is to develop "the habit of checking where a QR code comes from." Three habits greatly reduce the risk: checking whether a QR code posted in a public place has been covered with a replacement, verifying the sender of QR codes in emails and SMS, and checking the domain of the URL displayed after scanning.