Malicious QR Codes Stuck in Public Places through an app

How it looks through an app, the red flags and what to do.

Scam apps pretend to be a bank, a loan service, a game, a government service or a "support tool", and they ask for access to SMS, contacts, the screen or accessibility. Malicious QR Codes Stuck in Public Places is one of the ways this shows up: A QR sticker on a parking meter, restaurant table or poster leads to a fake payment page or an app download. Check where it goes before you pay.

What malicious qr codes stuck in public places looks like through an app

• A loan app that asks for contacts and photos.
• A "KYC", "challan" or "bank rewards" app from a link.
• An .apk file sent on WhatsApp or by SMS.

The set-up is a printed sticker that matches the look of a legitimate notice, placed on top of an authentic code or on a spot where payments are common: parking areas, charging stations, bus stops, ATM kiosks and event posters. The sticker may be slightly raised or have a different colour, but most people do not notice. The code leads to a web page that copies a payment gateway, an offer page or a login form.

Red flags to check on the app

• A QR sticker looks pasted over another code or has uneven edges.
• The page that opens does not show the venue's real name or the payee's name.
• A parking or menu page asks for card details or a login.
• A code starts a download or asks you to install an app.
• It has few or odd reviews, or a name with spelling changes.
• It asks you to turn off Play Protect.

What to do

1. Before paying, look at the address the code opens and the payee's name in your payment app.
2. Prefer paying through the venue's official app or at the counter.
3. Do not enter card details or install apps from a scanned code.
4. Change the passwords of your bank and email from a clean device if the app had access.
5. Run a phone scan (Safeavio Sentinel lists risky apps and settings).
6. Call your bank, and call 1930 if money moved.

Report the fake app to the store it came from and, if money moved, call 1930 and report at cybercrime.gov.in.

If money or a code is already gone

1. Call 1930 and report at cybercrime.gov.in with the payment reference.
2. Call your bank through the number on your card and ask to block the card if details were typed.
3. Remove any app you installed and change passwords from a safe device.
4. Keep a photo of the sticker and the location for your report.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

QR check in Safeavio Sentinel scans a QR code and shows where it goes before you pay or open it, which helps you notice an odd address or a payee that does not match the venue. Link check can test the address further. Phone scan helps if an app was installed from a code. Safeavio cannot tell whether a sticker was swapped and cannot recover money paid.

Full guide: Malicious QR Codes Stuck in Public Places: how it works, signs and what to do. Other channels: QR code, social media, SMS.

Questions