QR Code Scams Surging: BBB Urges High Alert

From paying for parking to pulling up a restaurant menu, QR codes have become a part of our daily lives. However, the Better Business Bureau (BBB) issued a warning on Tuesday urging consumers to "be on high alert," as scammers are increasingly using these convenient squares to steal sensitive information in a tactic known as quishing, or QR code phishing.

How QR Code Scams Work

The danger of a QR code scam lies in its simplicity. According to Steve J. Bernas, president and CEO of the BBB, producing a fraudulent QR code has never been easier for scammers. They simply create a code that directs to a malicious website and then print it on a sticker. This fake QR code can then be placed directly over a legitimate one on a sign, flyer, or payment terminal.

Because the human eye cannot read the data embedded in a QR code, there's no way to tell if it's safe just by looking at it. Once you scan the malicious code, it can take you to a counterfeit website designed to look like a real payment portal or login page. If you enter your credit card number, bank details, or password, that information goes straight to the scammer. The goal is to trick you into giving up your money or personal identity under the guise of a legitimate transaction or offer.

Common Places to Find Fake QR Codes

Scammers are placing these malicious codes in high-traffic public areas where people expect to use them. The BBB has received reports of fake QR codes appearing in a variety of places, including:

• Public Payment Terminals: Be extra cautious at parking meters or on public transit payment machines, where fraudsters may stick a fake QR decal on top of the real one.
• Advertisements and Flyers: Promotional materials for events are another common target. A code promising a discount or more information could lead to a dangerous site.
• Mail and Deliveries: Scammers may put a sticker on a package or include a fraudulent code in an unsolicited email or text message, often with an urgent message about a delivery issue.
• Public Fixtures: Fake QR codes have been found stuck to traffic signal lights, signposts, and even the windows of empty storefronts to lure in curious passersby.

How to Prevent QR Code Scams and Improve Security

While scammers are clever, a few simple precautions can significantly reduce your risk of falling for a quishing attack.

• Physically inspect the code. Before you scan, take a close look. Does it appear to be a sticker placed over another image? If a code looks like it may have been tampered with, it's best to avoid it.
• Verify the source. Never scan codes from strangers or those received in unsolicited emails, texts, or pop-up ads. Only scan codes from sources you implicitly trust.
• Check the URL after scanning. Once your phone scans the code, it should show you a preview of the website URL before opening it. Look carefully at this link. Does it look legitimate, or does it contain typos or random characters? Be especially wary of links that use URL shorteners, as they can hide the true destination.
• Don't enter information immediately. If a QR code takes you to a page asking for a password or financial information, pause. Manually type the website's official address into your browser to ensure you are on the legitimate site, not a counterfeit one.