Phishing scams using QR codes are surging, here's what you should know

The QR code scams are rising significantly in the country. In the last 14 days, over 2000 such emails have been sent to over 1100 customers. Check how these phishing scams work

As someone said, technology is a useful servant but a dangerous master. This is proving true in today’s times. QR codes are one of the best ways to make payment but it is also a great tool for scammers to target people. 

According to a report published by a cybersecurity company, hackers have figured out new ways to deploy QR codes in phishing campaigns. 

Check Point has shared a report claiming hackers are using QR Code Routing Attacks where they can use custom templates specific to each organisation, making every attack unique to the company and individual.

The report stated that in the last 14 days, over 2,000 of these emails were found to be spread over 1,100 customers.

 

How does this ‘new’ QR Code campaign work?

• The 'new' phishing campaign attack looks like an authentic update and it is delivered to people via emails. 
• The message sent to people mentions that their account authentication will quickly expire to avoid mail disruptions which is required to re-authenticate the account. 
• The campaign is very dangerous since these messages have a legitimate company logo. These changes are brought depending on the company targeted which makes the phishing attack seem more legitimate and personalised. 
• The reports claim that the formula is the same, i.e., add company logo, add victim name, and implore them to update their authentication before incurring issues with their email.
• When users scan the QR code it is directed to a credential harvesting site. Since the attacks play on urgency like suggesting that email access will be altered and consequently users may get inclined to act quickly.
• It must be noted that the usage of the QR code also conveys a layer of trust as end-users are accustomed to using QR codes – a technology that’s familiar, especially with the rise of digital payments in a country like India.
• The message then asks users to scan a QR code that opens the door to compromise that device with a potential threat.
• Users must always treat the emails and messages that are showing 'urgent' with caution and should avoid scanning the QR code.
• Carefully check the message for any suspicious email addresses and spelling mistakes for the veracity of the message.