Malicious QR Codes Stuck in Public Places on social media

How it looks on social media, the red flags and what to do.

Social media scams use real-looking profiles, reels, ads and direct messages. The account may look old, and the comments may be bought. Malicious QR Codes Stuck in Public Places is one of the ways this shows up: A QR sticker on a parking meter, restaurant table or poster leads to a fake payment page or an app download. Check where it goes before you pay.

What malicious qr codes stuck in public places looks like on social media

• An ad with a celebrity face and a payment link.
• A "friend" account that is a copy of someone you know.
• A comment thread full of identical "thank you" replies.

The set-up is a printed sticker that matches the look of a legitimate notice, placed on top of an authentic code or on a spot where payments are common: parking areas, charging stations, bus stops, ATM kiosks and event posters. The sticker may be slightly raised or have a different colour, but most people do not notice. The code leads to a web page that copies a payment gateway, an offer page or a login form.

Red flags to check on the social media message

• A QR sticker looks pasted over another code or has uneven edges.
• The page that opens does not show the venue's real name or the payee's name.
• A parking or menu page asks for card details or a login.
• A code starts a download or asks you to install an app.
• The profile is new, or the followers are bots.
• The offer is far better than any normal shop or job.

What to do

1. Before paying, look at the address the code opens and the payee's name in your payment app.
2. Prefer paying through the venue's official app or at the counter.
3. Do not enter card details or install apps from a scanned code.
4. Check the account: when it was created, who follows it, and whether the real brand links to it from its own website.
5. Report the account or ad inside the app and block it.
6. Make your own profile private and review who can message you.

Use Report on the profile, post or ad. If money was lost, call 1930 and report at cybercrime.gov.in.

If money or a code is already gone

1. Call 1930 and report at cybercrime.gov.in with the payment reference.
2. Call your bank through the number on your card and ask to block the card if details were typed.
3. Remove any app you installed and change passwords from a safe device.
4. Keep a photo of the sticker and the location for your report.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

QR check in Safeavio Sentinel scans a QR code and shows where it goes before you pay or open it, which helps you notice an odd address or a payee that does not match the venue. Link check can test the address further. Phone scan helps if an app was installed from a code. Safeavio cannot tell whether a sticker was swapped and cannot recover money paid.

Full guide: Malicious QR Codes Stuck in Public Places: how it works, signs and what to do. Other channels: QR code, fake app, SMS.

Questions