Beware of QR Code scams

QR codes are everywhere. You can find them at restaurants, on flyers, delivered through the post, in emails, and more. They are convenient and easy to use, but they can also be dangerous. Cybercriminals can use QR codes to trick you into visiting malicious websites, downloading malware, or giving away your personal or financial information. This type of attack is called QR code phishing or quishing.

Last year, drivers were alerted to new parking scams using QR codes stuck to parking meters and lampposts. The QR codes prompted the installation of a fraudulent app to setup recurring payments for car parking. The app deducted small amounts to go undetected, however, it was indeed fake, and those small payments were sent to a fraudster. Drivers were unaware that they did not pay their parking fees which could have resulted in a fine or a penalty charge notice.

How can you spot and avoid QR code scams?

• Don’t scan unknown QR codes

Only scan QR codes from trusted sources, such as official websites where you initiated the creation of a QR code for MFA app registration purposes. If you receive a QR code in an email, text message, or social media post, don’t scan it unless you are sure it is legitimate.

• Check the URL before scanning

Some QR codes have the URL printed below them. If you see a URL, make sure it matches the expected destination. If the URL looks suspicious, don’t scan the QR code.

• Use a QR code scanner with security features

Some QR code scanners have built-in security features that can warn you if the QR code is malicious or redirecting you to a harmful website. You can also use a browser extension or app that can scan QR codes and check their safety.

• Don’t enter any personal or financial information

If you scan a QR code and it takes you to a website that asks you to enter your username, password, credit card number, or other sensitive information, don’t do it. It could be a phishing website that is trying to steal your identity or money. Some of these sites are capable of monitoring field completion without the need for you to click submit, the moment the data has been entered into the relevant fields it should be treated as compromised. Only enter your information on secure and verified websites that you trust.

• Report any suspicious QR codes

If you encounter a QR code in an email that you think is malicious, report it using the 'How to spot phishing and report it' guide.

QR codes can be useful and convenient, but they can also be risky. By following these tips, you can protect yourself from QR code scams and enjoy the benefits of QR codes safely.

If you have been redirected by a QR code to a suspicious site and you have entered credentials into any of the fields, please reset your University account password by either visiting the 'Security Info' or 'Password' section found at: https://myaccount.microsoft.com/