Should businesses and consumers be wary of QR codes?
Quick Response bar codes (better known as QR codes) are everywhere, from restaurant menus to product packaging. One company even floated one across fans’ television screens during the Super Bowl this year. But should businesses and consumers be wary of QR codes?
QR Code Use Increased During the Pandemic
Essentially, a QR code is a square barcode that a smartphone camera can scan and read to provide quick access to a website, prompt the download of an application, and direct payment to an intended recipient. The use of QR codes grew exponentially during the COVID-19 pandemic as they allowed businesses to provide “touch-free” services to customers and eliminate the need for paper items, such as menus and bills.
FBI Bulletin Warns Cybercriminals Are Targeting QR Codes
Unfortunately, cybercriminals have taken notice of our increased reliance on QR codes and stepped up their attacks. The increased cyber risks of using QR codes recently prompted the Federal Bureau of Investigation to issue an alert to both businesses and consumers.
“Businesses use QR codes legitimately to provide convenient contactless access and have used them more frequently during the COVID-19 pandemic,” the FBI bulletin stated. “However, cybercriminals are taking advantage of this technology by directing QR code scans to malicious sites to steal victim data, embedding malware to gain access to the victim’s device, and redirecting payment for cybercriminal use.”
Cybercriminals are targeting both digital and physical QR codes by replacing legitimate codes with malicious codes. According to the FBI, in a typical QR code scam, a victim scans what they think to be a legitimate code but the tampered code directs victims to a malicious site, which prompts them to enter login and financial information. Access to this victim information allows the hacker to potentially steal funds through victim accounts. Malicious QR codes may also contain embedded malware, which provides access to the victim’s mobile device and allows hackers to steal the victim’s location, along with personal and financial information.
Another version of the scam involves QR codes used by businesses to facilitate payment. When a business provides customers with a QR code directing them to a site where they can complete a payment transaction, cybercriminals can replace the intended code with a tampered QR code and redirect the sender’s payment for cybercriminal use.
The FBI offers the following tips to lower the risk of falling victim to QR code fraud:
Once you scan a QR code, check the URL to make sure it is the intended site and looks authentic. A malicious domain name may be similar to the intended URL but with typos or a misplaced letter.
Practice caution when entering login, personal, or financial information from a site navigated to from a QR code.
If scanning a physical QR code, ensure the code has not been tampered with, such as with a sticker placed on top of the original code.
Do not download an app from a QR code. Use your phone’s app store for a safer download.
If you receive an email stating a payment failed from a company you recently made a purchase with and the company states you can only complete the payment through a QR code, call the company to verify. Locate the company’s phone number through a trusted site rather than a number provided in the email.
Do not download a QR code scanner app. This increases your risk of downloading malware onto your device. Most phones have a built-in scanner through the camera app.
If you receive a QR code that you believe to be from someone you know, reach out to them through a known number or address to verify that the code is from them.
Avoid making payments through a site navigated to from a QR code. Instead, manually enter a known and trusted URL to complete the payment.
For businesses, there are also steps you can take to deter QR code fraud. Examples include generating dynamic QR codes at checkout, regularly policing QR codes for tampering, and not placing physical QR codes where they can easily be tampered with. While you likely will not be held liable if a customer is scammed, because QR fraud can’t erode trust and damage your brand, it is important to be vigilant.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Does Your Homeowners Insurance Provide Adequate Coverage?
Your home is likely your greatest asset, which is why it is so important to adequately protect it. Homeowners insurance protects you from the financial costs of unforeseen losses, such as theft, fire, and natural disasters, by helping you rebuild and replace possessions that were lost While the definition of “adequate” coverage depends upon a […]
Understanding the Importance of a Non-Contingent Offer
Making a non-contingent offer can dramatically increase your chances of securing a real estate transaction, particularly in competitive markets like New York City. However, buyers should understand that waiving contingencies, including those related to financing, or appraisals, also comes with significant risks. Determining your best strategy requires careful analysis of the property, the market, and […]
Fred D. Zemel Appointed Chair of Strategic Planning at Scarinci & Hollenbeck, LLC
Business Transactional Attorney Zemel to Spearhead Strategic Initiatives for Continued Growth and Innovation Little Falls, NJ – February 21, 2025 – Scarinci & Hollenbeck, LLC is pleased to announce that Partner Fred D. Zemel has been named Chair of the firm’s Strategic Planning Committee. In this role, Mr. Zemel will lead the committee in identifying, […]
Novation Agreement Process: Step-by-Step Guide for Businesses
Big changes sometimes occur during the life cycle of a contract. Cancelling a contract outright can be bad for your reputation and your bottom line. Businesses need to know how to best address a change in circumstances, while also protecting their legal rights. One option is to transfer the “benefits and the burdens” of a […]
What Is a Trade Secret? Key Elements and Legal Protections Explained
What is a trade secret and why you you protect them? Technology has made trade secret theft even easier and more prevalent. In fact, businesses lose billions of dollars every year due to trade secret theft committed by employees, competitors, and even foreign governments. But what is a trade secret? And how do you protect […]
What Is Title Insurance? Safeguarding Against Title Defects
If you are considering the purchase of a property, you may wonder — what is title insurance, do I need it, and why do I need it? Even seasoned property owners may question if the added expense and extra paperwork is really necessary, especially considering that people and entities insured by title insurance make fewer […]
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Sign up to get the latest from our attorneys!
Explore What Matters Most to You.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
Are QR Codes Convenient or Risky? What Your Business Needs to Know
Author: Scarinci Hollenbeck, LLC
Should businesses and consumers be wary of QR codes?
Quick Response bar codes (better known as QR codes) are everywhere, from restaurant menus to product packaging. One company even floated one across fans’ television screens during the Super Bowl this year. But should businesses and consumers be wary of QR codes?
QR Code Use Increased During the Pandemic
Essentially, a QR code is a square barcode that a smartphone camera can scan and read to provide quick access to a website, prompt the download of an application, and direct payment to an intended recipient. The use of QR codes grew exponentially during the COVID-19 pandemic as they allowed businesses to provide “touch-free” services to customers and eliminate the need for paper items, such as menus and bills.
FBI Bulletin Warns Cybercriminals Are Targeting QR Codes
Unfortunately, cybercriminals have taken notice of our increased reliance on QR codes and stepped up their attacks. The increased cyber risks of using QR codes recently prompted the Federal Bureau of Investigation to issue an alert to both businesses and consumers.
“Businesses use QR codes legitimately to provide convenient contactless access and have used them more frequently during the COVID-19 pandemic,” the FBI bulletin stated. “However, cybercriminals are taking advantage of this technology by directing QR code scans to malicious sites to steal victim data, embedding malware to gain access to the victim’s device, and redirecting payment for cybercriminal use.”
Cybercriminals are targeting both digital and physical QR codes by replacing legitimate codes with malicious codes. According to the FBI, in a typical QR code scam, a victim scans what they think to be a legitimate code but the tampered code directs victims to a malicious site, which prompts them to enter login and financial information. Access to this victim information allows the hacker to potentially steal funds through victim accounts. Malicious QR codes may also contain embedded malware, which provides access to the victim’s mobile device and allows hackers to steal the victim’s location, along with personal and financial information.
Another version of the scam involves QR codes used by businesses to facilitate payment. When a business provides customers with a QR code directing them to a site where they can complete a payment transaction, cybercriminals can replace the intended code with a tampered QR code and redirect the sender’s payment for cybercriminal use.
The FBI offers the following tips to lower the risk of falling victim to QR code fraud:
Once you scan a QR code, check the URL to make sure it is the intended site and looks authentic. A malicious domain name may be similar to the intended URL but with typos or a misplaced letter.
Practice caution when entering login, personal, or financial information from a site navigated to from a QR code.
If scanning a physical QR code, ensure the code has not been tampered with, such as with a sticker placed on top of the original code.
Do not download an app from a QR code. Use your phone’s app store for a safer download.
If you receive an email stating a payment failed from a company you recently made a purchase with and the company states you can only complete the payment through a QR code, call the company to verify. Locate the company’s phone number through a trusted site rather than a number provided in the email.
Do not download a QR code scanner app. This increases your risk of downloading malware onto your device. Most phones have a built-in scanner through the camera app.
If you receive a QR code that you believe to be from someone you know, reach out to them through a known number or address to verify that the code is from them.
Avoid making payments through a site navigated to from a QR code. Instead, manually enter a known and trusted URL to complete the payment.
For businesses, there are also steps you can take to deter QR code fraud. Examples include generating dynamic QR codes at checkout, regularly policing QR codes for tampering, and not placing physical QR codes where they can easily be tampered with. While you likely will not be held liable if a customer is scammed, because QR fraud can’t erode trust and damage your brand, it is important to be vigilant.
If you have questions, please contact us
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!
