Is That QR Code Safe?

QR codes have quickly become more commonplace in our lives, especially during the pandemic. Instead of a physical restaurant menu, informational material, physical map, etc., businesses can post a sign with a QR code and their customers can snap it on their smartphone to be taken to a website with the information they’re seeking. And for consumer transactions, QR codes are being used to direct payers to an app to download or an ecommerce site to complete purchases.

Similar in scope and criminal intent to credit card skimmers installed onto gas station pumps and ATMs to collect consumer credit and debit card information, this cybercrime is executed by developing a fake website that looks exactly like what the consumer is expecting to see, a payment form for example — but it’s collecting the sensitive personal information for use in identity theft or straight-out fraudulent purchases on the consumer’s credit or debit card as soon as the data is submitted. After that fake website is built, all the criminal needs to do is replace the QR code the consumer will snap on their phone – which could be nothing more than slipping a sticker with the replacement QR code on top of the legitimate code, taking half a second and likely nobody noticing.

Worse yet, the QR code could lead the consumer to install a seemingly-harmless app onto their phone, but is actually malware designed to infiltrate the consumer’s phone, and possibly their entire online life.

QR codes are extremely convenient, is a “green” alternative to paper-based materials, and, as this pandemic has illustrated, a good tool for public health. But it requires consumers to be extremely trusting, assume their sensitive personal and financial data is going to where they think it is, and/or assume the phone app they’re being directed to install is legitimate.

GlobalAutoID’s Solution Partner, iTrace Technologies, is working to eliminate that need for such blind trust by providing an alternative to QR codes that is secure and un-hackable.