Malicious QR Codes Stuck in Public Places by SMS

How it looks by SMS, the red flags and what to do.

A text message is the cheapest way for a scammer to reach thousands of phones at once, and the sender name can look like a bank, a courier or a government office. Malicious QR Codes Stuck in Public Places is one of the ways this shows up: A QR sticker on a parking meter, restaurant table or poster leads to a fake payment page or an app download. Check where it goes before you pay.

What malicious qr codes stuck in public places looks like by SMS

• A shortened or oddly spelled link that does not match the real website.
• A request to call a number, install an app or share an OTP.
• Several near-identical messages arriving together from different senders.

The set-up is a printed sticker that matches the look of a legitimate notice, placed on top of an authentic code or on a spot where payments are common: parking areas, charging stations, bus stops, ATM kiosks and event posters. The sticker may be slightly raised or have a different colour, but most people do not notice. The code leads to a web page that copies a payment gateway, an offer page or a login form.

Red flags to check on the text message

• A QR sticker looks pasted over another code or has uneven edges.
• The page that opens does not show the venue's real name or the payee's name.
• A parking or menu page asks for card details or a login.
• A code starts a download or asks you to install an app.
• The message asks for an OTP, PIN, card number or password.
• It threatens blocking, arrest, disconnection or a fine unless you act at once.

What to do

1. Before paying, look at the address the code opens and the payee's name in your payment app.
2. Prefer paying through the venue's official app or at the counter.
3. Do not enter card details or install apps from a scanned code.
4. Report the sender on the Sanchar Saathi portal (Chakshu facility) and block the number.
5. Delete the message and tell family members who may get the same text.
6. Do not reply, do not tap the link and do not call the number in the message.

You can report suspicious SMS and calls on the Sanchar Saathi portal (Chakshu facility) of the Department of Telecommunications.

If money or a code is already gone

1. Call 1930 and report at cybercrime.gov.in with the payment reference.
2. Call your bank through the number on your card and ask to block the card if details were typed.
3. Remove any app you installed and change passwords from a safe device.
4. Keep a photo of the sticker and the location for your report.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

QR check in Safeavio Sentinel scans a QR code and shows where it goes before you pay or open it, which helps you notice an odd address or a payee that does not match the venue. Link check can test the address further. Phone scan helps if an app was installed from a code. Safeavio cannot tell whether a sticker was swapped and cannot recover money paid.

Full guide: Malicious QR Codes Stuck in Public Places: how it works, signs and what to do. Other channels: QR code, fake app, social media.

Questions