How fraudsters are scamming people with QR codes on restaurant menus – Birmingham Live

Cyber criminals have latched on to the rise in popularity of QR codes, it has been warned. They are using them to gain access to people’s personal information by hacking, scamming and causing malware infections on people’s phones and personal electronic devices.

There are a number of techniques that crooks are using – QR phishing, QRL jacking, QR crypto scams and drive-by QR Code phishing. Those terms may sound confusing, but a breakdown of them reveals how cyber crooks are taking advantage of the technology, which works like barcodes.

The use of QR codes has increased massively within restaurant menus over the past two years, sparked by the coronavirus pandemic, as it has removed the need for paper menus. It sees instructions embedded into a black and white dot-based image – similar to a barcode – which is then translated into human-readable information once scanned with a phone. According to TitanHQ, an anti-phishing platform, almost 84 per cent of smartphone users have scanned a QR code at least once, and over 34 per cent scan a QR code once a week.

READ MORE:Dad slapped with £60 fine after hidden change to car parking rules

QR codes usually contain web links or links to media such as videos or links to download an app. This use of links in a QR code provides a cybercriminal with the opportunity to perform phishing – where fraudulent messages are sent pretending to be a legitimate person or organisation.

With a QR code scam, the scammer replaces the legitimate menu QR code with a malicious one. Instead of taking the customer to the restaurant website, the fake QR codes takes them to a fake website designed to mimic the real account and have the customer divulge personal data.

QR phishing

QR phishing, also known as quishing, is a mashup of QR codes and email phishing, where fraudsters embed a malicious QR code into a legitimate-looking email. Recently, a Microsoft Office 365 phishing campaign used QR codes to steal log-in credentials.

Researchers identified spoof Office 365 emails that offered access to missed voicemail messages by scanning a QR code. Scanning the QR code took the user to a fake Office 365 page, which requested credentials to gain access to the message.

QR codes are also being used in various regular scam types, such as tax scams. The UK tax department, HMRC, recently added support for QR codes on their website.

However, fraudsters have now used this new feature as a basis for a new QR code tax phishing scam. The spoof HMRC email asks the recipient to scan the code to pay overdue tax. The QR code takes the taxpayer to a spoof site where their financial information is then stolen.

QRL Jacking

This is an older version of the more recent Quishing scam, but one that has phishing implications. QR codes are very convenient for users, and some companies have extended this convenience to their log-in systems, where users scan a QR code to log-in to an account. In QRL Jacking, an attacker navigates to a legitimate site, initiating a session and generating the QR code to log in. The attackers then capture this QR code (for example, using screen scraping) and places this legitimate QR code on a spoof site.

The attacker then uses spear-phishing to target an individual, tricking them into going to the spoof site. The target then uses the captured QR code to log-in; this logs into the original session, thus logging the attacker into the legitimate account. This scam is more challenging to carry out as it is time-sensitive; however, it will be worth the effort if this is a high-value or sensitive account.

QR crypto scams

QR codes are often used to make it more convenient to download a legitimate app. However, they can be used to encourage people to download malicious apps, including crypto-wallets.

For example, a QR crypto-quishing scam could involve capturing persistent consent – prior to authorization – to use the wallet, allowing them to drain it of cryptocurrency.

Drive-by QR code phishing

Drive-by downloads of malware are one of the most insidious forms of malware infection. An example would see a person land on an infected site, and a flaw in any software that they use can open the door to malware infection.

QR code phishers take advantage of drive-by download opportunities by sending phishing emails with QR codes that take the recipient to an infected website. One scan of the code and their mobile device may become infected with a trojan.

Ways to prevent QR code phishing

QR codes are one method in a long line of phishers’ favorites. No matter what technology comes along, fraudsters will find a way to exploit it if it is popular.

Moreover, a single-point solution cannot capture all possible cyber-attack scenarios. Clever attack chains require a creative response, comprising a mix of security awareness training with advanced AI-enabled spam and content filters.

READ MORE:

Total
0
Shares
Leave a Reply

Your email address will not be published. Required fields are marked *

Previous Post

Remote working visas: what HR needs to know – People Management Magazine

Next Post

Satya Nadella addresses the next generation of UK game makers at Xbox Academy – Microsoft

Related Posts