QR codes have gained importance in times of pandemics. Thanks to its use, we can read the menus in bars and restaurants or add contacts to WhatsApp.
This growing popularity has not gone unnoticed by fraudsters, who can use them to affect users who inadvertently read something they shouldn’t on their devices. Below we share all the risks you can take.
Proceeding to a Malicious Page
Phishing attacks don’t just spread through emails, instant messages, or texts. Just as attackers can use malicious advertisements and other techniques to direct victims to fraudulent sites, they can do the same with QR codes.
According to the cybersecurity company ESET, this is especially worrying if the codes are placed in advertisements in crowded areas or near banks or other financial institutions.
Downloading a Virus
As we said, many bars and restaurants use QR codes so that you can download a menu in PDF format or install an application that allows you to place an order.
Scammers could easily manipulate the QR code to trick users into downloading a malicious PDF file or a fraudulent mobile app.
Activate Activities on your Device
QR codes can trigger actions directly on your device, and these actions depend on the app reading them (in fact, watch out for fake barcode scanning apps).
However, there are some basic actions that any essential QR reader can interpret. These include connecting the device to a WiFi network, sending an email or SMS message with a predefined text, or saving contact information on the device.
Although these actions themselves are not malicious, they could use them to cause a device to connect to a compromised network or send messages on behalf of the victim.
Redirect a Payment
Today, most financial applications allow payments to be made through QR codes that contain data on the recipient of the money. Many stores show these codes to their customers and thus facilitate the transaction.
However, an attacker could modify this QR with their data and receive payments in their account. It could also generate codes with requests to collect money to trick buyers.
Identicalness Theft
Many QR codes are used as certificates to verify a person’s information, such as their ID or vaccination pass. In these cases, the QR codes can contain information as sensitive as that contained in your ID or medical history, which an attacker could quickly obtain by scanning the QR code.
Without going any further, many applications, such as WhatsApp, Telegram or Discord, sometimes use QR codes to authenticate user sessions and thus access their accounts.
As has already happened with WhatsApp, with attacks such as QRLjacking, attackers can trick a user by impersonating the service’s identity and tricking the user into scanning the QR provided by the attacker.
In most cases, the attacker will need to generate a malicious QR code that replaces the original code that the victim will scan.
In other words, the attacks involve social engineering and are based on tricking the victim into carrying out a malicious action.