The Growing Threat of QR Code Scams
QR codes have become a ubiquitous part of daily life in the United States, from restaurant menus to parking meters. However, their widespread use has also made them a prime target for cybercriminals. According to NordVPN, 73% of Americans scan QR codes without verification, and more than 26 million people have already been directed to malicious websites. This alarming trend has led to increased warnings from government agencies and cybersecurity experts about the dangers associated with these seemingly harmless codes.
The Federal Trade Commission (FTC) issued a warning earlier this year about scanning QR codes on unexpected packages. These codes could lead users to phishing websites that steal personal information such as credit card numbers or usernames and passwords. In New York City, the Department of Transportation warned residents about fake QR codes on parking meters that are not legitimate payment links. Similarly, Hawaii Electric issued a similar alert to its customers.
A Shift from Traditional Phishing
QR code scams are on the rise as traditional phishing methods become less effective. Cybersecurity experts note that scammers are exploiting the convenience of QR codes, which are often used in urgent situations where users may not take the time to verify the source. Gaurav Sharma, a professor at the University of Rochester, explains that attackers rely on urgency and the assumption that users are in a hurry. “The crooks are relying on you being in a hurry and you needing to do something,” he said.
A study by KeepNet Labs found that 26% of all malicious links are now sent via QR codes. This increase is partly due to the fact that more safeguards have been put in place to combat email phishing. As a result, cybercriminals are turning to QR codes as a more effective method of deception.
Innovations in QR Code Security
To combat this growing threat, researchers are developing new ways to secure QR codes. Sharma is working on a “smart” QR code called SDMQR (Self-Authenticating Dual-Modulated QR), which includes built-in security features to prevent scams. However, he needs support from major tech companies like Google and Microsoft to implement this solution effectively.
Some institutions are taking steps to fortify their QR codes against intrusion. For example, the Children’s Museum of Indianapolis upgraded its QR codes to include logos and colors, making it harder for scammers to mimic them. The museum also provides clear information about what users can expect when they scan a QR code and regularly inspects them for tampering.
Device-Specific Risks
QR code scams affect both Apple and Android devices, but iPhone users may be slightly more vulnerable. A study by Malwarebytes found that 70% of iPhone users have scanned a QR code to complete a purchase, compared to 63% of Android users. Researchers noted that iPhone users tend to trust their devices more, which could make them less cautious about potential threats. Fifty-five percent of iPhone users believe their device keeps them safe, compared to 50% of Android users.
The Hidden Dangers of QR Codes
Despite their convenience, QR codes pose significant risks because they are often used in everyday situations where users may not think twice about scanning them. Dustin Brewer, senior director of proactive cybersecurity services at BlueVoyant, warns that even legitimate flyers or official documents can be compromised. Attackers can easily replace genuine QR codes with fake ones, making it difficult for users to detect the deception.
Brewer also highlighted the potential for QR codes to be used in more sophisticated attacks, such as infiltrating critical networks or distributing malware. Nation-state actors have reportedly used QR codes to compromise messaging accounts and distribute remote access trojans (RATs), which allow hackers to gain full control of targeted devices.
A Low-Effort, High-Reward Tactic
Rob Lee, chief of research, AI, and emerging threats at the SANS Institute, described QR code scams as a low-effort, high-reward tactic for cybercriminals. He pointed out that QR codes were originally designed to make life easier, which makes them ideal for scammers. “We’ve seen this playbook before with phishing emails; now it just comes with a smiley pixelated square,” Lee said.
While QR code scams are not yet cause for panic, they represent a growing concern in the cybersecurity landscape. Experts recommend that users avoid scanning unwanted or unexpected QR codes and look for ones that display the URL address when scanned. As QR codes continue to become more integrated into daily life, staying vigilant is more important than ever.