One Scan — and Your Money Could Be Gone: How Scammers Use Fake QR Codes

QR codes have become a common way to pay for goods and services. We use them in cafés, parking lots, stores, and delivery services. However, scammers are increasingly taking advantage of this habit by replacing legitimate QR codes with fake ones that redirect users to fraudulent websites.

How the Scam Works

Scammers replace the original QR code with their own. After scanning it, the user is redirected to a phishing website that looks almost identical to the legitimate one. The fake site may ask you to:

• enter your bank card details;
• provide the verification code received via SMS;
• install an app or software update;
• follow an additional link.

As a result, scammers gain access to your banking information or infect your device with malicious software.

Where You May Encounter Fake QR Codes

Scammers most commonly place fake QR codes:

• in cafés instead of the digital menu;
• on parking payment terminals;
• in parcel delivery notices;
• in public places where QR codes are used for payments or accessing services.

How to Protect Yourself

To avoid becoming a victim of fraud:

• carefully inspect the QR code—it should not be pasted over another code;
• after scanning, check the website address: it should be the official website and begin with https;
• before making a payment, make sure the company’s payment details and the payment amount are correct;
• never enter your CVV, PIN, or verification codes if you have any doubts about the authenticity of the website;
• download apps only from the App Store or Google Play;
• if you are unsure, use an alternative payment method, such as paying at the cashier, through a payment terminal, or via your bank’s official mobile app;
• enable SMS or push notifications for your bank card and set limits on online transactions.

If You Have Already Scanned a Suspicious QR Code

Act as quickly as possible:

• contact your bank and block your card if necessary;
• change the passwords for your online banking, email, and other important accounts;
• enable two-factor authentication;
• scan your device with antivirus software and closely monitor your account activity over the next few days.

The most important rule: Never trust a QR code simply because it is located in a familiar place. Always check which website you have been redirected to before entering any payment information.

Source: Fingramota.kz