What Is Quishing?

As technology evolves, so do the tactics of cybercriminals. One of the latest threats is quishing, or QR phishing, where scammers use QR codes to trick users into giving up sensitive information, downloading malicious software, or even stealing money. QR codes, those square barcodes that became popular during the pandemic, are now being exploited by criminals. Here’s what you need to know about quishing and how to protect yourself.

How Quishing Works

Smartphone users often rely on QR codes to access websites, view restaurant menus, download apps, or transfer money. In a quishing scam, a cybercriminal redirects or replaces a legitimate QR code with one that leads to a fake website they control. Once a user scans the code, the criminal can steal important data, download malware onto the device, or reroute payments intended for legitimate recipients. Quishing is particularly effective because QR codes cannot be read without electronic assistance.

Examples of Quishing

Here are three potential quishing scenarios:

• A criminal hides a fake URL in a QR code that sends an unsuspecting victim to a phishing website. The user might unknowingly provide personal or financial information, which the criminal can use to steal their identity.
• A criminal infects your smartphone or other electronic device with malware. This software might steal your sensitive data, access various files, or lock your device until you pay a ransom.
• A criminal alters a QR code to access your payment platforms, send fake emails from your account, or follow social media accounts they control.

Where Can You Find Altered QR Codes?

Doctored QR codes might be found in various places, including:

• Emails
• Text messages
• Social media posts
• Restaurants
• Bars
• Stores
• Parking meters
• Packages

How to Protect Yourself from Quishing

Here are eight tips for protecting yourself from quishing:

1. Be skeptical. Trust only those QR codes that you get from a person or organization that you recognize.
2. Watch out for modified QR codes. See whether the code appears to have been tampered with. For instance, is a sticker with a possibly phony QR code concealing a legitimate code?
3. Check the URL. If a URL pops up after scanning a QR code, examine the URL to see whether it looks authentic. For instance, if the URL is short or unreadable, the website you’re being sent to might be suspicious.
4. Beware of phony websites. If a QR code directs you to a website, look for signs that it’s illegitimate. For example, do you spot typos or misspelled words? Is the design sloppy? Is the website secure, meaning it starts with https:// and shows a padlock icon near the URL?
5. Resist downloading an app using a QR code. An app downloaded with a QR code might be malicious. To remain on the safe side, download the app from an app store.
6. Don’t download a QR code scanner app. Downloading a scanner app increases the possibility that you’ll download malware onto your smartphone or another device. Instead, use the scanner built into your device’s camera.
7. Be careful with data. Don’t provide credit card numbers or login credentials on a website that you reached using a QR code.
8. Install security software. Be sure your smartphone and other electronic devices are equipped with software that might prevent viruses or malware from causing problems. If you’ve already got security software, make sure it’s updated.

What to Do if You Scan a Fake QR Code

If you realize you’ve scanned a fake QR code, take these steps:

1. Change passwords. For any online account you believe has been compromised, change the password as soon as possible. A secure password should contain at least eight characters, including uppercase letters, lowercase letters, numbers, and symbols.
2. Contact your credit card issuers and banks. If you suspect you’re the victim of fraud related to a QR code, reach out to your banks and credit card issuers. They may need to close your accounts and open new ones.
3. Consider setting up a fraud alert and credit freeze. You have the right to create a free fraud alert and freeze your credit for free through the three major credit reporting agencies: Experian, TransUnion, and Equifax. A fraud alert requests that a company verifies your identity before extending new credit in your name, while a credit freeze limits access to your credit report.
4. Alert the Federal Trade Commission (FTC). If identity theft arises as a result of quishing, notify the FTC. The agency shares this information with law enforcement agencies to help investigate fraud.
5. Look into identity theft protection. Identity theft protection from Experian monitors credit applications, looks for and helps remove your information on the dark web, performs monthly privacy scans, and more to identify signs of identity theft.

The Bottom Line

Anyone who uses QR codes can become a victim of quishing, which crooks carry out to steal sensitive information from you or cause other damage. But you can prevent harm by taking steps such as closely examining QR codes that you scan to make sure they’re authentic and downloading QR codes only from trusted people or organizations.

Contact O1ne Mortgage for Your Mortgage Service Needs

At O1ne Mortgage, we prioritize your security and financial well-being. If you have any mortgage service needs, don’t hesitate to call us at 213-732-3074. Our team of experts is here to assist you with the best mortgage solutions tailored to your needs. Stay safe and secure with O1ne Mortgage!