SCAN THIS! — The growing abuse of QR codes in malware and payment scams prompts FTC warning The convenience of QR codes is a double-edged sword. Follow these tips to stay safe.
Dan Goodin – Dec 12, 2023 1:48 am UTC Enlarge / A woman scans a QR code in a caf to see the menu online. reader comments 43
The US Federal Trade Commission has become the latest organization to warn against the growing use of QR codes in scams that attempt to take control of smartphones, make fraudulent charges, or obtain personal information.
Short for quick response codes, QR codes are two-dimensional bar codes that automatically open a Web browser or app when theyre scanned using a phone camera. Restaurants, parking garages, merchants, and charities display them to make it easy for people to open online menus or to make online payments. QR codes are also used in security-sensitive contexts. YouTube, Apple TV, and dozens of other TV apps, for instance, allow someone to sign in to their account by scanning a QR code displayed on the screen. The code opens a page on a browser or app of the phone, where the account password is already stored. Once open, the page authenticates the same account to be opened on the TV app. Two-factor authentication apps provide a similar flow using QR codes when enrolling a new account.
The ubiquity of QR codes and the trust placed in them hasnt been lost on scammers, however. For more than two years now, parking lot kiosks that allow people to make payments through their phones have been a favorite target. Scammers paste QR codes over the legitimate ones. The scam QR codes lead to look-alike sites that funnel funds to fraudulent accounts rather than the ones controlled by the parking garage.
Further ReadingTorrent of image-based phishing emails are harder to detect and more convincingIn other cases, emails that attempt to steal passwords or install malware on user devices use QR codes to lure targets to malicious sites. Because the QR code is embedded into the email as an image, anti-phishing security software isnt able to detect that the link it leads to is malicious. By comparison, when the same malicious destination is presented as a text link in the email, it stands a much higher likelihood of being flagged by the security software. The ability to bypass such protections has led to a torrent of image-based phishes in recent months.
Last week, the FTC warned consumers to be on the lookout for these types of scams. Advertisement
A scammers QR code could take you to a spoofed site that looks real but isnt, the advisory stated. And if you log in to the spoofed site, the scammers could steal any information you enter. Or the QR code could install malware that steals your information before you realize it.
The warning came almost two years after the FBI issued a similar advisory. Guidance issued from both agencies include: After scanning a QR code, ensure that it leads to the official URL of the site or service that provided the code. As is the case with traditional phishing scams, malicious domain names may be almost identical to the intended one, except for a single misplaced letter. Enter login credentials, payment card information, or other sensitive data only after ensuring that the site opened by the QR code passes a close inspection using the criteria above. Before scanning a QR code presented on a menu, parking garage, vendor, or charity, ensure that it hasnt been tampered with. Carefully look for stickers placed on top of the original code. Be highly suspicious of any QR codes embedded into the body of an email. There are rarely legitimate reasons for benign emails from legitimate sites or services to use a QR code instead of a link. Dont install stand-alone QR code scanners on a phone without good reason and then only after first carefully scrutinizing the developer. Phones already have a built-in scanner available through the camera app that will be more trustworthy.
An additional word of caution when it comes to QR codes. Codes used to enroll a site into two-factor authentication from Google Authenticator, Authy, or another authenticator app provide the secret seed token that controls the ever-changing one-time password displayed by these apps. Dont allow anyone to view such QR codes. Re-enroll the site in the event the QR code is exposed. reader comments 43 Dan Goodin Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars
