QR codes have made a big comeback in recent years. While they became a necessity for some industries during the peak of COVID-19, small businesses are finding that their ability to direct current or potential customers to their websites, mobile apps, digital marketplaces or anything else available online is extremely valuable.
There are many legitimate and helpful uses for QR codes; however, scammers have also discovered success in using QR codes to carry out various schemes.
QR, or “quick response” codes read like bar codes but have a distinctive square shape that is filled with dots and smaller squares. When a smartphone scans a QR code, it translates the information to a link, which then leads to places like a website, a PDF of a restaurant menu, a Facebook page, the phone’s app store and more.
Unfortunately, because these codes can’t be read by the human eye, you can’t confirm which site you’ll be taken to ahead of arriving on the page. This makes users vulnerable and emphasizes why it’s so important to verify the authenticity of a code before scanning.
Consumer reports to Better Business Bureau and warnings issued by police departments in cities nationwide detail how some QR codes have been used to direct users to phishing websites, fraudulent payment portals and downloads that infect devices with viruses or malware. While the way victims are exposed to QR code fraud varies, a common theme identified in reports is that most come from unsolicited communications or a QR code posted in a publicly accessible location.
Here are some recent ways scammers are using QR codes:
— Parking meter payment. Fraudulent QR codes can be placed on the back of parking meters, leading victims to assume they are paying the correct company for parking. Con artists can easily create a QR code for free online, which they then print on stickers and either cover up an actual QR code or place where it makes logical sense. After paying for the spot through the QR code, some victims might return to find their vehicle has been towed or received a parking ticket for non-payment, multiplying the amount of money lost.
— Cryptocurrency wallets and romance scams. The rise of cryptocurrencies has altered traditional thinking about investments, and the confusion surrounding these transactions has made investment scams one of the riskiest scams in terms of loss of money. The trading of cryptocurrencies is conducted online, and the easiest way for both legitimate and fraudulent traders to direct investors to their digital wallets is through a QR code.
Recently, BBB has become aware of scammers who are willing to take months to build a romantic relationship with their victim and then ask for financial assistance or offer advice to the victim by getting them to engage in a cryptocurrency exchange. Some of these involve the use of a QR code that leads them to the digital wallet to make a financial transfer. Many victims lose thousands of dollars before they discover they are being scammed.
— Phishing scams. After scanning a code found in an email, text, postal mail or on a flyer, some victims are directed to a website that requests personal information that can lead to identity theft, compromised passwords for online accounts or downloads that track the user’s activity on the device. Many phishing attempts begin with a bogus notification of suspicious activity on one of their online accounts and include a link or QR code for the user to verify their identity. In reality, the information provided goes to a scammer, which they use to defraud the victim.
— Utility and government impostors. Many consumers have reported fake calls from someone claiming to be from their utility company, the Social Security Administration or the IRS regarding an outstanding debt they say must immediately pay in full. The representative claims that failure to pay the unpaid bill will result in either arrest, additional fines or shutting off access to electricity, gas or water.
According to the impostor, the regular payment portal for these services is currently offline, but the victim can submit payment through another portal which, conveniently, they can access by following a link or scanning a QR code. The payment portal the victim is directed to often mimics the real portal down to the finest detail, providing a false sense of security that it is legitimate.
How to avoid QR scams
If someone you know sends you a QR code, confirm that it is legitimate before scanning it. Whether you receive a text message from a friend or a message on social media from your workmate, contact that person directly before you scan the QR code to make sure they haven’t been hacked.
— Verify the source. If a QR code appears to come from a reputable source, it’s wise to double-check. If the correspondence appears to come from a government agency, call or visit their official website to confirm.
— Don’t open links from strangers. If you receive an unsolicited message from a stranger, don’t scan the QR code, even if they promise you exciting gifts or investment opportunities.
— Be wary of short links. If a URL-shortened link appears when you scan a QR code, understand that you can’t know where the code is directing you. It could be hiding a malicious URL.
— Watch out for advertising materials that have been tampered with. Some scammers attempt to mislead consumers and businesses by altering legitimate business ads, such as placing stickers over the QR code. Keep an eye out for signs of tampering.
— Install a QR scanner with added security. Some antivirus companies have QR scanner apps that check the safety of a scanned link before you open it. They can identify phishing scams, forced app downloads and other dangerous links.
For more information, you can reach your BBB at 423-266-6144 or tngabbb@chattanooga.bbb.org.
Michele Mason is president of the Better Business Bureau in Chattanooga.
Staff photo / hattanooga Better Business Bureau President Michele Mason