Beware of FTC's Warning: Not All QR Codes Are Safe, How to Avoid these Scams

The Federal Trade Commission (FTC) recently issued a consumer alert, urging the public to be cautious when scanning QR codes to avoid falling victim to potential scams. The FTC emphasized that the security and privacy risks associated with QR codes arise from the possibility of bad actors strategically placing them in inconspicuous locations or distributing them through text or email. In such scenarios, scammers patiently await an opportunity to exploit individuals for financial gains, access to login credentials, or other sensitive information.

A report by The New York Times highlighted findings from Trellix, a cybersecurity company, revealing over 60,000 instances of QR code attacks in the third quarter of the current year alone. The most prevalent scams identified involved impersonation of payroll and HR personnel, and postal scams. In the past year, several Texas cities reported cases of fraudulent QR codes affixed to parking meters, redirecting unsuspecting individuals to deceptive payment websites.

To safeguard against falling prey to malicious QR codes, the FTC recommends exercising caution with unexpected emails or messages that include urgent requests. Additionally, users are advised to scrutinize the URL displayed on their screens when scanning QR codes to ensure it corresponds to a trusted site. However, it is crucial to note that even legitimate QR codes may display garbled or abbreviated web addresses, making it prudent for users to directly visit the intended website if known.

The FTC also advocates for routine device updates and the implementation of strong passwords and multi-factor authentication for securing sensitive accounts. For those seeking guidance on setting up multi-factor authentication, the FTC directs individuals to its two-factor authentication guide, offering instructions for various famous sites and services.

In addition to the FTC's recommendations, users are cautioned against downloading third-party QR code scanning apps, as most built-in camera apps on Android and iOS devices already possess this capability. The FBI echoes similar sentiments in a blog published in September, emphasizing the importance of refraining from scanning QR codes if there is uncertainty about their legitimacy.