Why is this a problem?
QR codes are everywhere: in restaurants, mass transportation, commercials, signs, walls, bathrooms, advertisements, and even companies ship their products with QR codes, so consumers can access manuals on their phones.
We’ve all just accepted the QR code. And, to that end, we trust them. After all, how harmful can a simple QR code be? The answer to that question is…very. And cybercriminals are counting on the idea that most consumers always assume QR codes are harmless. Those same criminals also understand that their easiest targets are those on mobile phones. Why? Because most desktop operating systems include phishing protection. Phones, on the other hand, are far more vulnerable to those attacks.
Also: 9 top mobile security threats and how you can avoid them
At the moment, most quishing attacks involve criminals sending a QR code via email. Most often those emails act as a call out for users to verify accounts and that the user in question must act within a certain time frame or their account will be locked or closed. The idea is that a user would see the QR code in their desktop email and scan the code with their phone. Once scanned, the QR code would wreak havoc on the device.
Of course, that’s not the only way a threat actor could use a QR code to dupe people into falling for their scam. As I said, QR codes are everywhere. What’s stopping a cybercriminal from plastering QR codes everywhere, knowing some innocent bystander would scan the code to unleash whatever attack was planned?
What can you do?
The simplest thing you can do is not scan QR codes…especially those from unknown sources. The only time I ever scan a QR code is after I’ve verified the source. Even then, I’ll only scan it if I absolutely have to.
If you receive an email with a QR code, the first thing you should do is verify the validity of the sender. For example, if you receive an email with a QR code that purports to be from Company X but you look at the sender’s email and it’s from Gmail or some random (unknown) domain, chances are pretty good that’s a quishing attack.
Also: What is Facebook Protect? Here’s why you may be forced to turn it on
My best advice is that any QR code in an email should never be scanned. Legitimate companies will always send instructions on doing whatever it is you need to do. And most companies are certainly not going to send a QR code so you can verify your account. As for the random QR codes you encounter in the world? Just don’t. If you allow your curiosity to get the best of you, you might not enjoy the consequences.
Just like SMS messages from unknown sources, those QR codes could be hiding dangerous intent. So, unless you are 100% certain of the source of a QR code, never scan it with your phone.
Source: Information Technologies - zdnet.com
