Quishing: When QR codes become a trap

Contents:

• What is quishing? QR code scams explained simply

• Typical quishing scams: How fraudsters operate

• Spotting quishing: Look out for these warning signs

• Using QR codes safely: How to protect your data

• Swiss Bankers app: Greater security for your card

• Fallen victim to quishing? Here’s what you should do now

• Conclusion: Stay safe by keeping a watchful eye

What is quishing? QR code scams explained simply

Quishing combines the terms ‘QR code’ and ‘phishing’. Instead of a clickable link, fraudsters use a QR code that leads to a fake website. There, you may be asked, for example, to enter your login details, provide card information or confirm a payment. These sites can look deceptively similar to those of well-known companies. 

You cannot tell from the QR code itself which website it leads to. Anyone who spots one in an email on their computer often scans it with their smartphone – thereby switching to a different device. Furthermore, not all email security programmes check the codes contained within images. A QR code is therefore no guarantee that a message is trustworthy.

Typical phishing scams: How fraudsters operate

QR code scams can be encountered online, in your letterbox or whilst out and about. These examples show how everyday activities can turn into a trap:

• Fake invoices with QR codes: You receive what appears to be an invoice by email or post. The QR code leads to a fake payment page or contains the fraudsters’ payment details. You should therefore check whether you are actually expecting the invoice and verify the payee, IBAN and amount before authorising the payment. 

• Alleged security checks: An email asks you to confirm your identity or prevent your account from being blocked. The QR code leads to a fake login page. Such requests often combine a familiar sender with a sense of urgency.

• QR codes stuck over those on parking meters: Criminals stick their own code over the official one. The linked page looks like the car park operator’s payment portal, but actually intercepts payment details. Instead of paying a few francs in parking fees, this can result in a significantly higher charge. 

• Fake collection notices: A note in your letterbox claims that a parcel could not be delivered. You are asked to use the QR code to arrange a new delivery and pay a small fee. This may lead to a fake website designed to collect personal details and credit card information. The Federal Office for Cyber Security (BACS) has also documented this scam in Switzerland.

• Tampered codes in restaurants: QR codes on tables may also have been covered up. Instead of leading to the menu, they might take you to a supposed Wi-Fi login page, where entering your details could trigger an unwanted subscription.

Spotting quishing: look out for these warning signs

Whether on paper, in an email or at a parking meter: a fraudulent QR code is often difficult to spot. The following warning signs will help you assess suspicious situations:

• A QR code covered by a sticker: There is another sticker over the original code. You should take a closer look, particularly at publicly accessible parking meters or information boards.

• Time pressure or threats: You are told to scan immediately to prevent an alleged account freeze or to make an urgent payment. Such requests are designed to make you act without thinking.

• An incorrect web address: The address displayed after scanning does not match the provider’s known website. Watch out for minor spelling mistakes and unusual additions. A familiar company name alone is not enough.

• Unnecessary personal details: A menu asks for card details, or a supposed parcel redelivery asks for your date of birth. Ask yourself whether the information requested is actually necessary for the transaction in question.

• Discrepancies in payment details: When authorising payment, a higher amount or a different recipient than expected appears. An invoice for a service you have never ordered should also make you suspicious.

Use such anomalies as a reason to halt the transaction. If in doubt, open the official app or the well-known website yourself and verify the request via a trusted channel of communication.

Using QR codes safely: How to protect your data

Taking a moment to check can make all the difference. When dealing with unfamiliar QR codes, follow these steps:

1. Check the source: Think about whether you were expecting the message or request. If the code is displayed in a public place, check whether another code has been stuck over it.

2. View the link preview: Use your smartphone’s camera or a scanner that shows the destination before you open it. Do not tap the link that appears straight away.

3. Check the address: Examine the displayed address carefully. If it is shortened, incomplete or cannot be clearly identified, open the website you are familiar with or the provider’s official app instead. 

4. Avoid entering sensitive information: Log in to banks and other important services via the app you’ve opened yourself or the website you recognise. Do not enter login details on a page you’ve accessed via an unknown QR code.

5. Check payment details: Before authorising any payment, check the amount and the payee displayed. If these do not match your intended purchase, cancel the transaction. Do not confirm any unexpected payment presented as a ‘security check’ either.

If you still have any doubts, contact the provider via a source you have independently verified.

Swiss Bankers App: Greater security for your card

With the Swiss Bankers App, you can keep track of your card transactions and restrict specific payment functions. These features help you use your card securely:

1. Enable notifications: Receive notifications via the app about transactions on your card account. This allows you to spot any unfamiliar transactions promptly.

2. Block online purchases if necessary: If you’re not currently using your card online, you can block online purchases in the app and re-enable them when needed.

3. Check your transactions regularly: Monitor your card transactions and your balance directly in the app. Report any unauthorised charges to Swiss Bankers Customer Service immediately.

4. Check payment authorisations carefully: Mastercard Identity Check is automatically activated as soon as you add your card to the Swiss Bankers app. If you are asked to authorise an online payment, check the amount and the merchant displayed. Only confirm payments that you have initiated yourself and where the details are correct.

These security features complement your own vigilance when using QR codes. Continue to check which websites you entrust your details to and which payments you authorise.

Have you fallen victim to quishing? Here’s what you should do now

If you’ve entered any details or authorised a suspicious payment, act as soon as possible:

1. Cancel the transaction: Close the suspicious page. Do not enter any further details or security codes, and do not confirm any additional requests.

2. Secure your card: If you suspect your Swiss Bankers card has been misused, open the Swiss Bankers app and select the “Replace card” self-service option. The process will be initiated automatically; there is no need to block the card manually beforehand. If you are unable to use the app, contact the official customer service team immediately.

3. Change compromised passwords: Change any affected passwords via the genuine website or app. If you have used the same password for other services, change it there too. 

4. Check and dispute transactions: Check your card transactions. Report any unauthorised payments to your card provider. Swiss Bankers provides a form for disputing transactions.

5. Secure evidence and report the incident: Keep any messages, photos of the QR code and any payment receipts. Report the suspicious website via antiphishing.ch. If you have suffered financial loss, the BACS recommends reporting the matter to the police.

If your card details have been compromised, do not wait for a visible debit to appear. Inform the card issuer as soon as you suspect anything is amiss.

Conclusion: Stay safe on the move by taking a moment to check

QR codes have long been part of everyday life – when parking, in restaurants or whilst travelling. Precisely because scanning them is so quick and straightforward, it’s worth taking a moment to be vigilant. Check where a code comes from, which website it links to and whether the information requested fits the situation. Don’t let even a supposedly urgent message pressure you into entering details or authorising a payment in a hurry.

If you’re unsure, open the provider’s official app or well-known website yourself. The security features of the Swiss Bankers app also help you to monitor your card usage. And should you nevertheless have disclosed any details, react as quickly as possible. By taking this cautious approach, you can continue to enjoy the benefits of QR codes and spot attempts at fraud more easily.