How to ensure safety when scanning QR codes?

QR code (short for "Quick Response Code") is a type of two-dimensional barcode developed by Denso Wave Company (Japan) in 1994. QR codes are designed to store information and can be scanned quickly using devices such as smartphones or specialized QR code scanners.

QR codes are everywhere in our daily lives. You can easily see them on restaurant menus, at bus stops, or on websites and online applications. With their compact yet effective design, QR codes provide a quick and convenient way to convey information without taking up much space on a material or display screen.

With its widespread popularity and user-friendly features, many people often do not need to think much before scanning a QR code. Using just a smartphone with a code scanning application, it allows immediate access to information, from menus, website links, to contact information or even payments. This is why QR codes have become an indispensable tool in the digital age.

However, did you know that QR codes pose many security risks and are easily counterfeited? With just a few clicks, a bad actor can create a malicious QR code that will take you to phishing or malware sites. These sites can steal personal information, install spyware on your device, or even hijack your bank account.

Because of this potential danger, we must always be extremely cautious when scanning QR codes by applying some safety checks and verification measures. Below are the steps we should take to protect ourselves when using QR codes, from checking the origin of the code to how to handle the information after scanning.

1. Check for signs of counterfeiting

Generating QR codes is incredibly simple. There are now many free online tools that allow anyone to create their own QR codes in seconds. However, this convenience also comes with a big risk: scammers can easily take advantage of it to create fake QR codes. They can replace the legitimate QR code with their own, leading you to malicious or fraudulent websites. So how can you tell if a QR code has been faked?

Always look closely to see if a QR code has been tampered with. In particular, check to see if the QR code appears to be a sticker applied over the original code, or if it appears to have been printed separately and applied to the surface rather than integrated directly into the original design. Overlapping codes are often a sign that they may have been altered or modified by a bad actor.

Also, be careful with QR codes in locations that are susceptible to tampering, such as unattended parking lots, crowded restaurants, or high-traffic public places. In these cases, QR codes can easily be replaced without anyone noticing. Checking for unusual signs such as exposed adhesive, misaligned edges, or uneven surfaces can help you avoid scanning a fake QR code.

2. Determine the origin of the QR code

When you encounter QR codes in physical locations, such as restaurants, cafes, or stores, if you feel doubtful about its authenticity, don't hesitate to ask the staff for confirmation. They can confirm whether it is an official QR code provided by the establishment, helping you avoid unnecessary risks.

However, the story gets more complicated when it comes to online QR codes. In the digital environment, there is no human agent to check, and QR codes can be embedded in emails, websites, or even social media. This requires you to be much more cautious, knowing how to check the source of the code and making sure you are not being led to malicious or phishing links.

Hackers often impersonate legitimate businesses by creating phishing websites or sending emails containing malicious QR codes. These codes are designed to trick you into trusting them and leading you to dangerous links. So if you come across a QR code online, don’t rush to scan it. Instead, take a few minutes to double-check its source, such as the sender’s email or the website you’re visiting.

Also, keep an eye out for any signs of mismatch, such as an unofficial domain name, a non-standard logo, or content with grammatical or spelling errors. These inconsistencies are often a clear sign that something is amiss. If you have any doubts about the authenticity, it is best to not proceed and stay away from that QR code to protect your personal information.

3. Verify website address

Scammers often take advantage of the habit of not double-checking the website address (URL) before opening links that are linked to by QR codes. This gives them the opportunity to embed malicious links into the code without your knowledge. Of course, the content of a QR code cannot be read by the naked eye, but that doesn't mean you can't verify it.

After scanning the QR code, take a few seconds to check the URL preview that appears on your device's screen. Most QR code scanning apps offer this feature. Make sure that the link looks trustworthy, such as the correct domain name, and does not contain strange or suspicious characters. If you see anything unusual, do not click the link to avoid the risk of being scammed or going to a malicious website.

4. Be wary of requests for access to apps

If you scan a QR code and receive a request for access to your contacts, messages, camera, or location for no apparent reason, consider this a major red flag. These requests are often unnecessary for the QR code's basic functionality and can be a sign of malicious behavior.

Unintentionally granting permissions can allow bad guys to collect personal information, track your activities, or even take partial control of your phone. This not only violates your privacy, but also poses the risk of data or digital asset theft. Always think carefully before accepting any requests and decline if you feel unsafe.

5. Pay attention to warnings from your web browser

Many people have made the mistake of accidentally scanning a QR code without checking the URL preview first. However, in this case, your web browser will detect it and display a warning that the site is not secure.

If you scan a QR code and it tries to redirect you to a website, always pay attention to any warnings your browser or device displays. These warnings are often designed to protect you from potential threats, such as phishing or malware-containing websites.

Stop immediately if you see messages like "This site is untrusted" or "Connection not secure". It's important not to ignore these warning signs, as they could save you from losing your personal information or important data.

In particular, if you don’t have automatic updates enabled, turn it on immediately. This will ensure that your smartphone is always protected with the latest security patches. If not, make sure to manually update your operating system, apps, and related software regularly. Keeping your device up to date is an important step in protecting your personal information and preventing threats from malware or security vulnerabilities.