Scammers are weaponising QR codes — here’s how to avoid getting caught

One of the worst parts about getting scammed is the shame, and that shame just plays into the hands of the crooks.

If we don't spread the personal stories, then no one gets warned.

So, good on Les Howard who told his story of getting QR code scammed to the BBC earlier this week.

Les, quite understandably, feel victim to what's widely known in the security industry as quishing (QR phishing).

Les scanned a QR code that he thought was to pay for his parking, downloaded the app, put in his card details and then watched as chunks of cash were removed from his account day after day.

Not great.

There are a number of different ways that QR scams work.

Les Howard experienced the fake app routine, but it could just have easily been a link to a fake website, mocked up to look exactly like the real one.

AI can work marvels these days when it comes to creating duplicate web pages.

You can just as easily get done by the QR scanner apps themselves, which will take a legitimate QR and send you anywhere it wants to, adding all sorts of other links or scraping the details that you send through.

Now, this doesn't mean that we shouldn't use QR codes.

We just need to be a bit more careful about it.

The two most important pieces of advice are to use the QR scanner that comes baked into your phone's camera app, if you have one, and, second, use a QR code checker app to make sure what you're scanning isn't a scam.

There are free online tools for the job, such as Is This QR Safe and DNS Checker but they also come bundled in with other tools such as antivirus and VPNs .