One QR Code Scan Could Empty Your Bank Account?!

You had food at a restaurant and the bill arrived. You scanned the QR code on the table, made the payment within two minutes and forgot about it. But what if that QR code was actually a trap set by a cybercriminal?

The QR code may look like it is for checking the menu. It could be for paying a parking fee or charging your electric vehicle. But instead of taking you to the real website, it may take you to a fake website created by a hacker. That’s where the real trouble begins.

Do You Scan a QR Code the Moment You See One?

For most of us, QR codes have become a normal part of everyday life. Even for paying ten rupees for a cup of tea, we use a QR code. We use them to pay restaurant bills, parking fees and even to check online offers. It has become such a common habit that we often don’t stop to ask one simple question: Is this QR code real?

Cybercriminals are now using this habit against us. This new type of scam is called “Quishing”. The word comes from QR Code + Phishing. In phishing, criminals use fake links to trick people. In quishing, they use fake QR codes to do the same thing.

Hackers Can Steal Your Data Without Hacking Your Phone

This is what makes the scam even more dangerous. The hacker may not need to break into your phone. They may not need to install a virus or break your phone’s security. They simply trick you into giving them your information. In some cases, they may even trick you into approving a payment yourself.

Think about it this way. The thief is not breaking down your door to enter your house. You are opening the door and inviting him in.

One “Pay Now” Message Is Enough!

Quishing often works by creating a sense of urgency. You may see messages such as, “Pay your parking fine now,” “Your parcel delivery is on hold,” or “Your EV charging payment is pending.” Another message may warn you that an extra charge will be added if you don’t pay immediately.

When we see such messages, we often don’t stop to think. First, we get scared. Then, we scan. And that is exactly what the hacker wants.

EV Charging Stations and Restaurants Are Also Targets

Electric vehicle charging stations can be attractive targets for these scams. When the battery is almost empty, the driver doesn’t want to waste even a minute. They see a QR code, scan it and make the payment. That hurry can work in the criminal’s favour.

Restaurants can have the same problem. You see a QR code on the table and naturally assume that it belongs to the restaurant. But what if someone has placed a fake sticker over the original QR code? You scan it to see the menu, while somewhere else, a scammer may be waiting for your money.

Should We Stop Using QR Codes Completely?

Not at all. QR codes are not dangerous by themselves. What matters is where the QR code came from and where it takes you. If you see a QR code in a public place, take a moment to check it. If it looks like another sticker has been placed over the original code, don’t scan it.

After scanning, check the website address that opens. If the page asks for your banking details, OTP, CVV or password, stop immediately. Whenever possible, use the official app of the service instead of scanning a random QR code. If something feels suspicious, skip the QR code and type the company’s official website address directly into your browser.

Remember One Simple Rule

Until now, we have learned one important rule: “Don’t click on unknown links.”

Now we need to remember one more: “Don’t scan unknown QR codes.”

— Surya Prakash Josyula