QR Code Scams
QR code scams
QR codes, short for "quick response" codes, are widely used across the globe. People use them to make peer-to-peer payments, check restaurant menus, pay at parking meters, or check into concerts or events. Businesses also use QR codes for advertising and order deliveries, while schools and healthcare providers use them to quickly share information with visitors.
However, in countries like India, the USA, the UK, and Australia, scammers have started exploiting this convenience. They replace real QR codes with fake ones, tricking people into scanning them. Scanning these fake codes can lead people to phishing websites from where scammers can steal their sensitive information like banking credentials, email, passwords, and identity-related information. These phishing scams involving QR codes are also known as ‘Quishing Scams.’
How does a QR code (quishing) scam work?
Scammers often post fake listings on classifieds and online platforms, offering items that don’t actually exist. When interested buyers contact them, scammers claim that they’ll send a small advance payment to confirm the buyer’s identity or complete the verification. In India, scammers send a QR code, asking the victim to scan it to “accept” the payment of just 1 rupee. However, instead of receiving money, people unknowingly authorise a transfer, losing funds to the scammer’s account instead. This scam is widely reported in India.
In Australia, the USA, and the UK, scammers put fake QR code stickers over real ones on parking meters. When people scan these fake codes, they are taken to a fake website. Once the victim enters their card details, the scammers gain access to their credentials.
In the UK, scammers replaced a genuine QR code with a fake one, leading a 71-year-old woman to a fraudulent website. After stealing her bank and card details, the scammers pretended to be from her bank, tricking her into giving more information. They used this to open a new account in her name and ran up £13,000 in debt.
If the QR code contains malware, scammers can install screen-mirroring software or download malicious apps in the background. This fraudulent software gives scammers full access to your device, allowing them to steal sensitive information and authorise transactions without your knowledge. This kind of QR code scam is often reported in India.
Commonly seen in the US, this scam involves fraudsters sending a fake package to the victim's address with a note inside that reads, 'Scan to see your gift.' When individuals scan the code with their phone camera, scammers gain access to their devices and personal information.
Individuals are often targeted with fraudulent QR codes in texts or emails claiming there's an issue with your account or warning of “suspicious activity.” The message usually urges recipients to scan the code to “verify” their details. When they scan it, they are redirected to a fake website that asks for sensitive information, such as bank or login details, which the scammers then use to steal personal information. This type of scam has been frequently reported in the US.
How to protect yourself from quishing scams
Scanning codes from unsolicited messages, public places or ads make you more susceptible to scams. As a rule, only scan from verified accounts or official business displays.
After scanning the QR code, there is a preview URL that pops up -- read it carefully before making any sort of payment. Spell errors and weird URLs are very likely a scam.
Remember, no legitimate website will ask you to enter your credit card details, CVV, or any other sensitive information via QR codes.
Emails and texts regarding suspicious account activity may appear important, but do not scan any QR code to “find out more” or “resolve” the issue. If the message claims to be from a bank, contact the bank directly or use their official communication channels.
Truecaller can detect and block calls or texts from scammers, helping you save time and money. This extra layer of protection makes your communication safer and more secure.
What to do after a QR code scam
- Contact local authorities: As soon as possible, gather all the evidence and contact local authorities.
- Run an antivirus scan: If you clicked on a suspicious link and suspect that malware was installed on your device, your first step should be to run an antivirus scan.
- Contact your bank: Your bank can help you freeze the account, thereby preventing any unauthorised transactions.
- Change passwords: Change the passwords for your emails, online banking, and any other accounts linked to your device as soon as possible.
- Monitor your accounts: Keep a close watch on your financial statements for any further suspicious activity.
- Report the number: To help others avoid falling for the same scam, it is important to report the number on the Truecaller app.
Protect yourself from QR code scams with Truecaller
Download Free!Where to report a QR code scam
- Action fraud
- Helpline: 0300 123 2040
- Federal Trade Commission
- Internet Crime Complaint Centre: https://www.ic3.gov/
Conclusion
Scammers are increasingly using fake QR codes to steal personal and financial information. To protect yourself, only scan codes from trusted sources, check URLs carefully, and avoid sharing sensitive details. If you become a victim, report the scam immediately through official channels, run antivirus scans, contact your bank, and update your email and banking passwords.