QR Codes Can be a Quick Rip-off

If you want to see the cutting edge of technology, look at advancements that make it easier for organizations of any type, from charities to retailers, to get money from you.

QR (Quick Response) codes are everywhere these days. QR codes make many things easier and faster - not just for the consumer, but for the cyber crook as well. You can even scan them right off your television screen, which should be safe. However not all of these codes are trustworthy – some are traps or scams.

Many restaurants make their menu accessible on your phone by capturing the code on a sign when you enter. Check to make sure it’s not a fake code on a sticker covering the real code, because that’s one trick crooks pull – distract the host/hostess while an accomplice plasters the malicious code onto the sign.

Cyber criminals are cashing in with phony QR codes that take you to websites they spoofed (copied). Then they either steal your information OR lockup your phone – or even your work computer and network with Ransomware.

Consumer need to be careful about routinely capturing codes offering great deals – especially if they appear on the phone unsolicited. It is just that kind of advertising that enables the big ‘free’ social media companies to make tens of billions of dollars per year. There are so many ads bouncing onto a consumer’s screen that it’s difficult to spot the scams.

As an extra layer of Cybersecurity, Google offers a QR code sign-in. You must be signed into your Google account on at least one device already. Even though Google employs reasonably decent Cybersecurity measures, ANY website can be spoofed and provide the user with a malicious QR code.

Consumers and their smart phones have always been relatively easy marks for criminals. Mobile security provider MobileIron surveyed over 2,100 end-users across the US and UK and found results that were not at all comforting. Mobile users as a rule do not understand QR codes or their potential risks – 71% of those surveyed said they could not tell the difference between a malicious or a legitimate QR code. 51% of respondents had no idea what kind of security they had on their mobile devices – or even if they had any at all. Many don’t find out until they find themselves in a world of hurt.

The crooks targeting consumers are typically small-time, and they usually do not have IT services at their disposal – crooks usually just hit them for a couple hundred bucks and move on. The big-time criminals go after bigger money from businesses. This is where real IT support needs to stand guard.

How do I make sure a QR code is safe?

The FBI published advice on how to avoid these scams along with warnings:
“Here’s how to protect yourself:

• Do not scan a randomly found QR code.
  
• Be suspicious if, after scanning a QR code, the site asks for a password or login info.
  
• Do not scan QR codes received in emails unless you know they are legitimate. Call the sender to
  confirm.
  
• Some scammers are physically pasting bogus codes over legitimate ones. If it looks as though a code
  has been tampered with at your local bar or restaurant, don’t use it. Same thing with legitimate ads
  you pick up or get in the mail.”

Cyber criminals have been perfecting their ability to infect business networks, and they are already doing it – both through phishing emails containing QR codes and through phones connected to business networks.

Phone to Network

Not too many years ago, only field personnel and management needed to have their smart phones connected to the office network. Since the massive rise in the remote workforce, employees who work remotely are typically connected on several different devices: desktops/laptops, phones, and tablets. The smart phone used to scan a code is a direct bridge to the office network. If a QR code is malicious, it would then have network access.

The growing threat of fake QR codes was a subject in a recent zoom symposium between ITFirm.com and a number of network security specialists across the country. Remote devices, especially phones, have long been the weakest link in security defenses.

This bolsters our encouragement to have employees undergo regular Security Awareness Training. Just as we at ITFirm.com teach our clients how to spot phishing emails and send them immediately to our IT HelpDesk, we have included the scanning of QR codes. Cybersecurity is not just the concern of IT Support – the end users must be on board and vigilant.

Once the crooks are in your phone – and your phone is connected to the network – they are in your network, and your in-house IT team or outsourced Managed IT Services provider is scrambling to contain the malware and negate the effects.