Nowadays, QR codes are everywhere. While they make it easier to access websites, apps, and more, iconic codes have given hackers a new way to acquire money or private information. Enter: Quishing. Read on to learn more about quishing scams, why they are concerning, and how to protect yourself from falling victim.

What is a quishing scam?

A QR code, short for “quick response” code, is a two-dimensional barcode made of small black squares that store information from tickets to restaurant menus. Since it can be scanned with the camera of a smartphone or tablet, the technology makes it easy to obtain information in an instant.

This easy access is also attractive to criminals and has given rise to a scam called “quishing” or QR phishing. Like traditional phishing attacks, it is done to get you to unknowingly hand over private or financial information, but it all starts with a QR code.

How does quishing work?

In many cases, a quishing attack begins with a email. The QR code is often sent as a message attachment and appears to come from a legitimate source, such as a bank lender, reports TechRadar.com.

Then when you scan the code it will take you to a malicious link on iInternet. The scammer expects you to submit your information believing you are logging into an official website (like a bank, for example).

In more sophisticated cases, the scammer can cause even more damage. Scanning that fake code can install malware or other dangerous software that could infect your device, according to experts at Experian.com. This may result in a data breach or bricking of your device unless you pay the “ransom” demanded.

The scammer can also direct an altered QR code to access any payment platform you use, follow certain social media accounts you own, or send emails using your email address. This can essentially expand the scope of cybercrime as other people become targets of phishing attacks from their hacked accounts.

Why is quishing so dangerous?

A suspicious email or text message may be enough to alert you that something is wrong, which will hopefully stop you from scanning the fake digital QR code. But quishing is starting to spread to public places, making the scam that much more worrying.

In fact, it has been reported in three states so far, according to KJCT News in Colorado, and the Interstate Technology and Regulatory Council expects the scam to become even more widespread. These cases have involved posting fraudulent QR codes in public places where it would make sense for them to appear.

Manipulated QR codes can appear in restaurants, stores, bars, on packages, or even in parking meters/garages. This was becoming a major problem in the uk this summer, with scammers pasting these codes on the parking machines. Users would then be taken to a website designed to steal sensitive information when they believed they were just paying their parking fees.

The big problem: any unsuspecting consumer or citizen will not be able to realize that they are being deceived. “Quishing is especially effective because it is impossible for a person to read a QR code without electronic assistance,” Experian professionals write.

The content of the codes can often be hidden and go unnoticed by cybersecurity tools, so you won’t know that the code you are seeing was created by a scammer. Even cyber experts have pointed out how advanced this scam can be depending on how tech-savvy the hacker is.

What to do if you have been “crushed”

If you believe you have been a victim of a quishing scam, your first step should be to protect your information. This means changing your login credentials and passwords for online accounts. If you suspect you have been financially affected, you should contact your credit card company or bank.

For added security, you may want to create a free fraud alert through the credit reporting agencies Experian, TransUnion, or Equifax. But if you experience identity theft, notify the Federal Trade Commission, who will help investigate this type of fraud.

How to avoid a quishing scam

Scammers may have found what they believe is a successful way to target people, but staying alert can ensure you don’t fall into their trap. Below are some useful ways to stay away from a quishing scam:

• Look for manipulated codes: If you’re scanning a paper QR code in a public place, make sure there are no additional stickers on top of the original code. These would indicate manipulated code placed by a bad actor.

• Check that it is authentic: Trust only codes from a person or organization you recognize. For example, if a restaurant supposedly has one for a menu, check with an employee to make sure the QR code is legitimate.

• Be careful with incomplete URLs: Carefully investigate the URL that comes from a QR code. A short website address that contains odd characters or does not begin with “may be fraudulent.” If in doubt, go to the official website of the organization or business.

• Don’t use one to download an app: Avoid downloading apps directly from a QR code. Instead, go to your device’s app store.

• Beware of unsolicited QR codes: When you receive an email with a QR code (or a text message) from an unexpected sender, don’t scan it. If you think it may be safe because it comes from someone you know, contact that person before taking any action.

Keep scrolling for more information:

Beware of this new Gmail AI scam – here’s how to keep your account safe

Evil Twin WiFi Scam: How to Stay Safe as Hackers Attack Free Networks in Public Places

There’s an email blackmail scam flooding inboxes everywhere – here’s how to protect yourself