Since the pandemic, we’ve all become familiar with QR codes. We use them for restaurant menus, bar orders, parking meters, and anything that needs a link from the physical world to the Internet.
But how do you know the tag you’re scanning isn’t a fake QR code?
According to research from McAfee, 68 percent of people surveyed scanned a QR code in the past three months, and 18 percent of them landed on a suspicious or unsafe page.
More than half of the group that found an unsafe page took risky actions like entering personal information or installing suspicious apps.
That’s why it’s so important to be vigilant about the QR codes you scan in the real world, and why you should consider using tools like McAfee Scam Detector.
What is Quishing?
“Quishing,” or QR code phishing, is a growing cybersecurity threat where attackers use a malicious QR code to trick a user into visiting a spoofed website or downloading a fake app.
Quishing can be particularly dangerous. Because the malicious link is embedded in a QR code, it often bypasses traditional device security that scans for suspicious text-based URLs.
Common attack methods see bad actors placing fake QR code stickers over legitimate ones in public spaces like parking meters, restaurants, and signage. PDF attachments, emails, and messages are another common delivery method.
Travellers and tourists are often high-risk targets because QR codes are so convenient and frequently used for navigation, on-site ticket purchases, and restaurant menus. In some countries, they’re even used for shopping and transport payments.
How can you prevent quishing attacks?
Make sure the code matches its surroundings. Codes that are printed directly on menus, table tags, and other signage are normal. Malicious QR codes are often stuck on top of legitimate ones.
Inspect the tag before you scan it. Raised or damaged edges, poor print quality, and misalignment should be a red flag.
Check the URL before tapping through. Phones show a link preview when scanning the QR code. Look for slight misspellings, extra characters, or domain names that don’t match what you’re scanning.
Be careful of QR codes sent via email or text. There are rare circumstances where these are legitimate, but you should carefully check them over before trusting them.
Use your phone’s camera app rather than a third-party code scanner app. Modern phones natively scan QR codes, you don’t need an app to do it for you. Some third-party scanner apps inject their own malware or ad-riddled URLs.
When in doubt, seek an alternative option. If you’re pretty sure the QR code isn’t legitimate, browse to the page yourself or find another option. Parking meters often let you pay on their own website, and restaurants usually let you order over the counter.
How McAfee Scam Detector prevents quishing
McAfee added instant QR code safety checks to Scam Detector earlier this year. In practice, when you scan a QR code with Scam Detector installed, it assesses the URL in real time and flags it before you tap through.
That gives you a fast, automatic way to check QR codes without any hassle.
Scam Detector doesn’t just protect against quishing. It can scan text messages, emails, and direct messages on platforms like WhatsApp and Messenger, even searching for scams without a URL.
All core McAfee plans include Scam Detector to help you stay ahead of scammers and other online and real-world threats.
The bottom line
QR codes have become one of the default ways we pay for bar tabs, parking, and even restaurant orders, but the convenience isn’t risk-free.
The good news is that spotting fake tags is as easy as a quick inspection and a bit of common sense.
McAfee Scam Detector helps in those instances where you don’t usually stop to check, such as when travelling or sitting down in an unfamiliar restaurant.
The most effective method to stay safe from QR code scams is a mix of both: double-check the QR code first, and let McAfee handle those instances when your habits slip.
Save Up to $150 off McAfee+ plans now!
Comments