QR codes have become ubiquitous, especially since the pandemic, but the Federal Trade Commission says consumers shouldn't let their guard down. In a blog post, the FTC warns that scammers can use the jumbles of black-and-white squares to hide harmful links and steal personal information. The agency says scammers often send QR codes by text or email, claiming that there is a problem with an account or that a delivery needs to be rescheduled. "These are all lies they tell you to create a sense of urgency," the FTC says. "They want you to scan the QR code and open the URL without thinking about it." The FTC says the dodgy codes could lead to sites where scammers can steal information, including payment details, or install malware on devices.
Scammers have also been covering up legitimate QR codes with fraudulent ones. Last year, QR codes that led to a false payment site were found on parking meters in several cities in Texas, the Verge reports. John Fokker at cybersecurity company Trellix tells the New York Times that the company detected more than 60,000 QR code attacks in the third quarter of this year. "The pandemic led to a resurgence of QR codes in our daily lives—everywhere from restaurant menus to use in doctors' offices—making QR codes an attractive vector for cybercriminals to use to target individuals and organizations around the world," Fokker says.
Fokker says some of the most common scams involve fraudsters impersonating HR, IT, or payroll departments. The FTC recommends closely inspecting URLs before opening them. "If it looks like a URL you recognize, make sure it's not spoofed—look for misspellings or a switched letter," the agency says. The FTC also recommends not scanning QR codes found in unexpected messages. It advises contacting the company directly, especially if the message claims immediate action needs to be taken. People should also keep their phone's OS up to date and protect online accounts "with strong passwords and multi-factor authentication," the agency says. (More cybercrime stories.)
,
uBlock 
,
and
Ghostery 
)
