Fraudsters could exploit the widespread use of QR codes at festivals and other events to direct consumers to phishing websites designed to steal personal and financial information.
Festival-goers are being warned to check QR codes before scanning them over the bank holiday weekend amid concerns that fraudsters could exploit their growing use at events.
The technique, known as QR code phishing or ‘quishing’, involves criminals placing malicious QR-code stickers over legitimate codes. Scanning the replacement can direct victims to convincing phishing websites designed to capture personal or financial information.
The approach could prove particularly effective at festivals and other large events, where visitors may routinely scan codes for parking, tickets, food and drink payments, maps and other services.
Jonathan Frost, Director of Global Advisory for EMEA at BioCatch, warned that familiarity with QR codes could make consumers less likely to question their legitimacy.
“With the bank holiday festival weekend coming up, it’s worth remembering that QR codes can create a blind spot for consumers. We scan them without thinking twice, particularly when they appear somewhere we expect to see them. Fraudsters exploit that trust by placing fake QR-code stickers over legitimate ones, sending people to convincing websites designed to steal personal or financial information.
“People should check for signs of tampering and look carefully at the website a code opens before entering any information. But the responsibility cannot sit with consumers alone. Festival organisers and businesses should regularly inspect QR codes, while technology companies need stronger protections to stop people reaching malicious sites in the first place.”
Frost’s advice includes checking physical QR codes for evidence that another sticker has been placed over the original and examining the destination website before entering passwords, payment details or other sensitive information.
He also stressed that preventing QR-code fraud should not depend solely on consumers, with event organisers and businesses having a role in regularly checking codes displayed at their venues.
