Tips from the inventor of the QR Code: How to protect against quishing

Fraudsters are increasingly taking advantage of the popularity of QR Codes. DENSO invented the QR Code 30 years ago and knows how users can protect themselves.

DüSSELDORF, GERMANY, November 12, 2024 /EINPresswire.com/ -- Cyber criminals have developed a new scam: They use manipulated QR Codes to lure people to fake websites with the aim of stealing money, tapping into personal data such as bank details or passwords or installing Trojans. To do this, they paste over QR Codes from legitimate providers, send fake letters from banks or authorities and distribute fake parking tickets. The name of the scam: “quishing”, a combination of “QR” and “phishing”. This refers to phishing with QR Codes, which has become increasingly widespread since the use of QR Codes skyrocketed due to the coronavirus measures during the pandemic. Some people are now unsure about using QR Codes.

“But there is actually no reason for this,” says Thomas Kurpjuweit, Technical Product Engineer at DENSO WAVE EUROPE, part of the Toyota Group. “The technology behind the QR Code is secure. However, as with conventional phishing via email, fraudsters rely on the carelessness of users who, out of good faith, open the links encoded in the QR Code without checking them first, or blindly trust the source of the QR Code. However, this risk exists with every activity on the internet and also with every other 2-dimensional code, such as data matrix codes. If you follow a few simple safety instructions, you can use a QR Code safely without any problems.”

As the inventor of the QR Code, DENSO recommends the following three steps to effectively protect yourself against fraud:

1. Critically check the QR Code itself or the carrier medium
Subsequent manipulation of a QR Code is not technically possible. Fraudsters must therefore create their own code and attach it to trustworthy places. Users should, therefore, carefully check the nature of a QR Code and its carrier medium: For example, if the QR Code is only stuck on or even sticks over another code, caution is advised. If the QR Code comes as part of a payment request - for example from the bank or tax office - this letter should also be checked carefully: Fraudsters often use a false sender address or incorrect names of authorities, for example.

2. Choose the right scanner app with a security prompt
When choosing a scanner app, users should make sure that it asks for confirmation before opening the scanned code. The user is shown the data stored in the QR Code and the URL of the stored link and is explicitly asked whether it should be opened. Most reputable QR Code scanners have this protection function, but some apps skip this step as it is quicker and therefore more convenient for the user. However, once a manipulated link has been opened, the damage is usually already done.

3. Check the continuative link
It only takes a moment, but can prevent greater damage: Before users give their scanner software the green light to open the link stored in the QR Code, they should critically check the URL again. Fake websites can be recognized, for example, by alternative spellings in the URL, which fraudsters change only minimally.

This shows that the responsible and secure use of QR Codes to protect against fraudsters is uncomplicated. It is now an important part of media literacy in the digital age, especially as the QR Code has become firmly established in everyday and professional life.

Masahiro Hara invented the QR Code at DENSO exactly 30 years ago. Today, DENSO WAVE EUROPE's solutions range from premium RFID readers, handheld terminals / mobile computers, and barcode scanners to complex, cloud-based IoT data management systems.

Merle-Marie Koske
DENSO WAVE EUROPE GmbH
+49 211 54013863
email us here