The simplicity and ubiquity of QR codes have lately become a gateway for more than just quick access to menus and payments. According to cybersecurity experts, these codes have also opened the door to a new form of deception, with scammers leveraging the public’s ease with 'quishing'—a phishing tactic via QR codes—to swipe personal data and funds. In a report by KTNV, Las Vegas locals have expressed their unease about the potential for their information to be compromised, even in settings as benign as a restaurant.
One local, Steven Smith, voiced his concerns, telling KTNV, "You don’t know if your information is being taken." Such suspicions are not unfounded, as even a casual outing to a food truck resulted in unwarranted access to personal information for a friend of Kayla Mercado, as she recounted in the same report. As these QR code scams consistently ensnare unwary victims, the Federal Trade Commission (FTC) has issued warnings to the public to rigorously scrutinize the QR codes they choose to quickly scan, especially if they appear to have been tampered with, like a sticker placed over another.
Las Vegas cybersecurity expert Paul Keener explained in an interview with 8 News Now about the inherent vulnerability in QR codes due to their design prioritizing convenience over security. "It’s very difficult for someone to look at a QR code and say that’s not legitimate," Keener said. This difficulty is a boon for criminals as the FBI reported a staggering $16 billion in losses last year from scams, about a quarter of which involved QR codes.
The FTC cautions consumers against blindly following QR codes found on mailed packages or public signs, suggesting these could be traps leading to counterfeit websites designed to filch credit card details or plant malware. Keener's advice echoes this sentiment: "If you see a QR code that says, Thanksgiving is almost here, or Black Friday, and you’ll get a good deal, such and such, those generally tend to be scams," as noted by 8 News Now. The same diligence applied when checking for skimmers at gas stations should be exercised when encountering QR codes slapped on unexpected places. Victims of such scams are urged to report these to the FBI's internet crime complaint center at ic3.gov and to the temporarily down FTC identity theft website, with operations to resume post-government shutdown.
