Don’t Be So Quick to Scan Every QR Code You See

There is no denying that Quick Response codes—better known as QR codes—are a handy little invention. Just a few years ago, many businesses heavily adopted these contactless communication tools, allowing customers with a smartphone to access menus, documents, and more with ease. Having said that, we unfortunately can’t deny that cybercriminals are taking advantage of how handy QR codes are, too.

Let’s talk about the rise in QR code fraud, as well as how you and your team can avoid it.

How Do QR Codes, and QR Code Fraud, Work?

First developed in 1994, a QR code is a two-dimensional version of a barcode, meant to adjust for the limitations of its predecessor. A traditional barcode is limited to 20 alphanumeric characters due to it only being able to be scanned horizontally. The QR code was then developed to hold exponentially more information in its combination of vertical and horizontal data as well as allow this data to be accessed at any angle.

While this makes the QR code a very appealing option for businesses, it also gives cybercriminals a relatively easy means of sharing malicious links and malware that has become largely trusted by people everywhere.

After all, if major brands are now displaying QR codes in their advertisements, they must be safe, right?

Unfortunately not. The utility offered by a QR code also applies to cybercriminals and scammers, who can use them to augment their attacks in numerous ways.

QR Codes Make Effective Phishing Tools

Phishing is one of the most unpleasant cyberthreats out there today, largely because it requires a user to be engaged and aware about their own cybersecurity at all times. It relies heavily on the target to not see it coming.

Now let me ask you this: would you hesitate to scan a QR code on a poster or a menu if prompted? If you’re like most people…probably not. It just isn’t how most people see a threat coming in.

This makes us vulnerable. This is why many of these threats have been spotted that pose as parking tickets, or as offers or loyalty programs attached to storefront doors.

Making this bad situation even worse, these attacks often don’t go into effect immediately. Instead, malware can be uploaded to the device that scans the malicious code where it will lie in wait until the opportune moment to strike arises. Many of these attacks will simply take notice if you use your device to access an account and record the credentials you use to access it, giving the attacker the keys to the castle.

Alternatively, some QR phishing tools will send users to a phishing website—one that poses as a legitimate one to fool the victim into handing their credentials over willingly. Some scams cover what were once legitimate codes with their own, diverting payments to their own accounts.

This Makes It Critical that You Protect Yourself

Whether you’re talking about your business or your personal life, QR code scams need to be avoided. Fortunately, there are a few somewhat familiar steps that you can follow to help ensure that you do so:

• Just like with other forms of phishing, any suspicious QR codes should prompt you to separately reach out to the party that supposedly shared it to confirm its legitimacy.
• Similarly, don’t hesitate to manually seek out what a QR code seems to offer.
• Using the security tools at your disposal, like antivirus or scam alert applications, to mitigate the risks associated with these scams helps protect you from falling victim to these attacks.

Washington Works is here to help protect your business from all types of threats, like this one and others. Give us a call at 301-571-5040 to learn more about what we can do for you.