Malicious QR Codes Stuck in Public Places through a QR code

How it looks through a QR code, the red flags and what to do.

QR scams work because people trust the little square. The code may open a payment screen, a fake website or an app download. Malicious QR Codes Stuck in Public Places is one of the ways this shows up: A QR sticker on a parking meter, restaurant table or poster leads to a fake payment page or an app download. Check where it goes before you pay.

What malicious qr codes stuck in public places looks like through a QR code

• A sticker pasted over a shop or parking QR code.
• A QR code sent on WhatsApp "to receive money".
• A code on a poster or flyer with a prize or a job offer.

The set-up is a printed sticker that matches the look of a legitimate notice, placed on top of an authentic code or on a spot where payments are common: parking areas, charging stations, bus stops, ATM kiosks and event posters. The sticker may be slightly raised or have a different colour, but most people do not notice. The code leads to a web page that copies a payment gateway, an offer page or a login form.

Red flags to check on the QR code

• A QR sticker looks pasted over another code or has uneven edges.
• The page that opens does not show the venue's real name or the payee's name.
• A parking or menu page asks for card details or a login.
• A code starts a download or asks you to install an app.
• The amount is filled in and you did not expect to pay.
• You are told to scan a QR code to receive money; you never need to scan to receive.

What to do

1. Before paying, look at the address the code opens and the payee's name in your payment app.
2. Prefer paying through the venue's official app or at the counter.
3. Do not enter card details or install apps from a scanned code.
4. Before paying, read the payee name and the amount on the payment screen.
5. Check where a code goes with a QR checker before you open the link (Safeavio Sentinel can do this).
6. Press on a shop code to see if it is a sticker; ask the shop to read out the name you should see.

If you lost money through a QR code, call 1930 and report at cybercrime.gov.in; tell the bank the transaction details.

If money or a code is already gone

1. Call 1930 and report at cybercrime.gov.in with the payment reference.
2. Call your bank through the number on your card and ask to block the card if details were typed.
3. Remove any app you installed and change passwords from a safe device.
4. Keep a photo of the sticker and the location for your report.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

QR check in Safeavio Sentinel scans a QR code and shows where it goes before you pay or open it, which helps you notice an odd address or a payee that does not match the venue. Link check can test the address further. Phone scan helps if an app was installed from a code. Safeavio cannot tell whether a sticker was swapped and cannot recover money paid.

Full guide: Malicious QR Codes Stuck in Public Places: how it works, signs and what to do. Other channels: fake app, social media, SMS.

Questions