Touchless QR codes: not so harmless as you may think

If you’ve been to a cafe or restaurant during the pandemic you already know about contactless QRs that are used as a substitution to a physical menu.

But only few know that scammers can use QR codes to get access to your personal data or force your device to instal malicious software.

We’re all aware why we shouldn’t click on suspicious links or open attachments in our emails. But Quick Response codes (QR codes) are a new thing and many of us unfortunately overlook potential threat that they can pose.

On one hand is’t a convenient tool allowing us to get information in a few seconds just using your phone’s camera. On the other - a tool for scammers to get their way to your data.

Pandemic gave hackers and scammers another opportunity to hunt for extra profit just by covering legitimate codes with bad ones.

It takes almost no time to stick a custom made code onto one that leads to a cafe’s menu. It’s especially easy if it’s an outdoor cafe and each table has one. Unfortunately when the scam will get noticed it can be too late.

Fake QR can lead you to a short link that hides the final destination. And if a scammer achieves their goal, the results may be drastical.

Every phone is a gateway to your accounts, financial and personal data. So scanning without double-checking the code first can lead to big trouble.

Sometimes your device becomes a part of a bot net - and a hacker can text all your contacts from the address book. In other cases they get access to your money and can make a payment in that way you will not be able to get it back.

In many cases short links take you to phishing sites that prompt your credentials so a scammer can steal and use them later. 

Things you must remember to stay safe:

• Never open links received from strangers. If you get a QR code from a person you don’t trust, don’t scan it even if their promises are very tempting.
  
  

• Don’t forget to verify sources. Even if you get a QR code from a government institution or a known company, better double check if it’s not a scam going to the official website.
  
  

• Don’t give any extra info: especially if it’s of personal kind. If after scanning a code you’re prompted to enter your login or password, it’s definitely a red flag.
  
  

• Short links are the enemy of your privacy. If you can’t clearly figure where a link goes, you can’t be sure that it’s not leading you to a url containing malicious code.
  
  

• Use a QR scanner with additional security functionality. Many antivirus companies produce scanners that check a link before opening it. Such apps can prevent forced application downloads of phishing.