Think twice before you scan the next QR code, scammers are creating fake codes to steal your money

QR codes have become increasingly popular in recent years, being used for everything from accessing websites to making payments. However, this convenience and increased usage is making them vulnerable to cybercriminals. Fraudsters are developing sophisticated ways to exploit QR codes and trick people for financial gains.

For instance, one of the highlighted cases where the exploitation of QR code technology was underscored occurred in 2021 when Harshita Kejriwal, daughter of Delhi Chief Minister Arvind Kejriwal, fell victim to a QR code scam while selling a sofa on an e-commerce platform. A potential buyer contacted her, agreed to the price, and sent a QR code for payment. However, upon scanning the code, Rs 34,000 were stolen from her account.

Another case involved a professor from the Indian Institute of Science, Bengaluru. He was selling a washing machine online when he received a message from a potential buyer who agreed to the price without negotiation. During the payment process, the buyer requested the professor to scan a QR code, promising quick payment. Unfortunately, as soon as the code was scanned, Rs 63,000 vanished from his account.

Even a member of the India Today Tech team faced a similar incident while transacting on OLX. Despite the potential buyer readily agreeing to the listed price and expressing interest in the item, red flags were raised when they hastily demanded the UPI ID and bank account details for payment without inspecting the item or negotiating. The situation escalated further when the buyer sent a suspicious QR code via WhatsApp and pressured our team member for a swift resolution through constant calls and messages. Fortunately, our team member recognised the scam and avoided falling victim to the fraudulent scheme.

However, these incidents highlight the danger of how well-crafted these scams can be and how scammers are currently trying to trick innocent people into falling prey to QR code scams. Let's take a brief look at how these scams unfold and how one can keep themselves safe.

Fake QR code and payments

One common QR code scam involves scammers posing as a potential buyer on online marketplaces like OLX or Quikr. The scammer expresses interest in purchasing an item and requests the seller's UPI ID or bank account details. They then send a QR code, claiming it's necessary to confirm the account information in order to send money.

However, unsuspecting victims don't realise that this QR code actually directs them to a fake website designed to resemble their bank's login page. Once they enter their credentials, the scammer steals their login information and gains access to their bank accounts.

Fake websites and malware

Scammers also use QR codes to redirect victims to malicious websites. These websites may contain malware that can hack into user's devices and steal personal information or install unwanted software on their device.

In another tactic, scammers send malicious emails claiming that your debit/credit card or bank account is about to expire and urge you to scan a QR code to 'renew' it. However, the attached QR code contains malware, and as soon as someone clicks on it, they are redirected to a website where their sensitive data is stolen.

How to be safe

• Here are some safety steps to protect yourself from QR code scams:
• Never share your UPI ID, bank account details, or OTP (One Time Password) with strangers.
• Remember, QR codes are primarily meant for sending money, not receiving it.
• Always verify the recipient's name, account number, and IFSC code before scanning any QR code for receiving money.
• Avoid scanning QR codes that appear suspicious, like stickers pasted over existing codes, as they might be tampered with.
• Use a QR code scanner app that allows URL preview before visiting it. Nowadays, camera apps in Android and iPhone do offer preview of the link.
• Verify the seller's identity before committing to transactions on online platforms.
• Resist sharing your mobile number unless absolutely necessary.