• scorpionix@feddit.de
    link
    fedilink
    English
    arrow-up
    36
    arrow-down
    4
    ·
    11 months ago

    So the issue isn’t QR codes, but people being unable to recognize scammers additions to public infrastructure and the websites being scams. Basically, it’s the same principle as scammers sticking an additional device on top of cash machines.

    No news here.

    • RGB3x3@lemmy.world
      link
      fedilink
      English
      arrow-up
      28
      arrow-down
      1
      ·
      11 months ago

      Okay, but explain to me how you’re supposed to tell the difference between a legitimate QR code and a fake one?

      It’s trivially easy to make a mockup of a restaurant’s QR menu so that people scan it when they sit down, expecting to get an online menu.

      • scorpionix@feddit.de
        link
        fedilink
        English
        arrow-up
        8
        arrow-down
        1
        ·
        11 months ago

        Is the QR Code applied professionally to the surface, possibly behind some security feature such as glass or another surface finish? Is the menu on the table in the general style of the restaurant, or does it look off or entirely different? Is the QR code applied on top of something else, possible another QR code?

        Don’t use apps which directly open QR codes. Any sensible app will tell what the information is before processing it.

        And at last, the simplest and most efficient security measure of all: Commonsense. Don’t scan everything you come across. Restaurant menu? Sure. Some random poster out in the woods promising a quick buck, happy time or their like? Hard pass.

        • Nollij@sopuli.xyz
          link
          fedilink
          English
          arrow-up
          16
          ·
          11 months ago

          Part of the problem with security is they even when it’s legitimate, it acts like the scammers.

          I’ve seen restaurants where their (legitimate) QR code is clearly printed on a home printer and used in lieu of physical menus in order to save money. If the link changes, they will simply tape the new one on top of the old, even on the most official copy you can find.

        • phx@lemmy.ca
          link
          fedilink
          English
          arrow-up
          9
          ·
          11 months ago

          Given that how restaurants present these various greatly, it wouldn’t be terribly unexpected for the official QR to be a sticker on the menu or table either

          • RGB3x3@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            11 months ago

            I’ve been at restaurants where that’s exactly the case. The QR is just a sticker on the table. Or a laminated card with the code on it.

            Would be trivially easy to replace it with a malicious site.

  • AutoTL;DR@lemmings.worldB
    link
    fedilink
    English
    arrow-up
    6
    ·
    11 months ago

    This is the best summary I could come up with:


    The US Federal Trade Commission has become the latest organization to warn against the growing use of QR codes in scams that attempt to take control of smartphones, make fraudulent charges, or obtain personal information.

    The code opens a page on a browser or app of the phone, where the account password is already stored.

    Two-factor authentication apps provide a similar flow using QR codes when enrolling a new account.

    For more than two years now, parking lot kiosks that allow people to make payments through their phones have been a favorite target.

    The scam QR codes lead to look-alike sites that funnel funds to fraudulent accounts rather than the ones controlled by the parking garage.

    “A scammer’s QR code could take you to a spoofed site that looks real but isn’t,” the advisory stated.


    The original article contains 389 words, the summary contains 135 words. Saved 65%. I’m a bot and I’m open source!

    • darkan15@lemmy.world
      link
      fedilink
      English
      arrow-up
      11
      ·
      edit-2
      11 months ago

      QR is just image to text, most QR reading apps I have used, show you the QR content before going to the website (or let you disable opening the link directly) so you should be able to check the URL or content and see if the link is legit or not.

      But let’s be honest most people don’t know or don’t even bother and that’s the real problem.

      • Nollij@sopuli.xyz
        link
        fedilink
        English
        arrow-up
        6
        ·
        11 months ago

        It’s also pretty easy to disguise the malicious part. For instance, hxxp://LegitimateBusiness.com@ScamMyAss.com

        (Hoping that didn’t get blocked as spam)

        On many apps, that would truncate somewhere around the .com

      • Sabata11792@kbin.social
        link
        fedilink
        arrow-up
        2
        ·
        11 months ago

        But let’s be honest most people don’t know or don’t even bother and that’s the real problem.

        100% they see the code and assume it can’t be mean.

  • McOkapi@lemmy.ml
    link
    fedilink
    English
    arrow-up
    1
    ·
    3 months ago

    I agree, people don’t really pay attention or bother to read about stuff like How to check if a QR code is safe. Honestly, I’ve been dealing with QR codes for quite a while, and I still occasionally spend time looking things up, reading about quishing, and whatever new scam/term appears.