Why should you be careful when scanning strange QR codes?

QR codes have now become a familiar part of modern life. They appear everywhere, from stores, supermarkets, in food services to product information retrieval.

Thanks to the ability to instantly access a website, Wi-Fi network or contact information with just one scan, QR codes have quickly become a convenient tool trusted by millions of people. However, this widespread popularity has also made QR codes a “delicious bait” for cybercriminals.

With just a few simple steps, anyone can create a QR code that looks completely legitimate. Scammers can replace real QR codes in public places with fake ones, or send them via email, text messages, and even insert them into online ads.

When you accidentally scan these malicious codes, they can lead to fraudulent websites, steal personal information, or silently install malware on your device.

Beware of QR codes in emails and packages of unknown origin

One of the increasingly popular forms of sophisticated phishing involves the use of QR codes in emails, known as “Quishing.” These emails are often cleverly designed to appear to come from reputable organizations, such as banks, technology services, or e-commerce platforms.

The message typically warns of a security breach, asks you to update your password or confirm your account information, and includes a QR code for you to “take immediate action.” But when you scan the code, it takes you to a fake website that asks for your login, credit card, or personal information, all of which is sent straight to the scammer.

QR code scams aren’t limited to emails and text messages. They also come in the form of surprise packages delivered to your home. Inside, there’s often just a simple piece of paper with a QR code and a message that intrigues you, like “Scan for a special gift” or “Scan to complete your return.” But these codes can actually lead to fraudulent websites or cause you to accidentally download malware disguised as legitimate apps.

QR code scams are particularly effective because they hide a malicious link behind a harmless-looking string of symbols. In fact, scanning an unknown QR code is just as dangerous as clicking on an unverified link, you never know what's waiting on the other side.

How to protect yourself from malicious QR codes?

While QR codes are convenient, scanning them carelessly can leave you open to sophisticated scams, so it's important to stay vigilant and take basic protection measures.

First, always question the origin of a QR code. If you receive a code in an unexpected email, strange text message, or unclear package, it's best not to scan it.

With QR codes in public places or restaurants, check carefully to see if the code is pasted over another code, or if there are any unusual signs in the brand name, logo or accompanying image, which could be a sign of counterfeiting.

When you're forced to scan a QR code, don't click the link right away. Most smartphones today, including iPhones and Android devices, show a preview of the link when you scan the code with the native camera app.

Treat these links with the same caution you would with a strange email: read the URL carefully, looking for typos, unfamiliar domains, or other unusual signs. If the QR code uses a link shortening service (like bit.ly), be extra cautious, as it can be difficult to know where the link actually goes.

If you happen to land on a suspicious website, do not enter any personal information. If you are asked to download an app, close the page and search for the app directly on the App Store or Google Play to ensure you do not accidentally install malware.

Finally, stay informed about new forms of QR code scams, early awareness is the best defense in the digital age.