How scammers use QR codes to steal—and how you can protect yourself

QR codes are also easy and cheap for anyone with a phone or computer to generate. The FBI reported about $150 million in losses attributable to QR code scams in the last year, sometimes referred to as "quishing."

The practice, in spirit, is the same as "phishing," where a criminal attempts to dupe their victim into revealing personal information that can be used to illicitly access sensitive platforms like banking and email accounts. In a quishing scheme, the criminal intercepts your device not with a shady email or text message but with a hyperlink to a website on your phone populated by the QR code when you scan it.

Numerous scams have been reported in which hackers place fake, malicious QR codes on parking meters, restaurant menus, advertisements, and other common locations for digital payments. In some cases, these methods can also steal credit card information stored on the phone used to scan the code.

Whenever you scan a QR code with your phone camera, a preview of the link will usually show up on your screen. Make sure the link looks like an official, secure website a legitimate business would host. For example, the standard protocol for secure websites requires that they begin with the string "https://" with the "s" standing for "secure."

Another form of attack commonly seen by cybersecurity firms has been dubbed QRLJacking. In this scheme, the victim receives a message containing a QR code, urging them to log in to a platform the victim already uses. When the victim logs in, they're entering their credentials into a fake version of a seemingly legitimate site, giving the attacker access to their actual account.

As a technology, QR codes allow users to move very quickly to the point of purchase. Remember to slow down and assess the situation.

If you receive an unexpected notification with an accompanying QR code via text message or email, be wary of any instructions urging you to act quickly. Cybercriminals commonly employ urgency tactics because they encourage uncertainty and rushed decisions—the psychological conditions to make it easier for the victim to make a mistake such as entering personal information into a webpage without thinking twice.

While QR codes are convenient for businesses to use for mass transactions, the benefits don't outweigh the risks in a direct payment situation when buying things secondhand, for example.

Cybersecurity firm KeepNet reported a scam in which the victim was sent a malicious QR code during a Facebook Marketplace transaction. Be wary of these, as navigating directly to a trusted payment platform like Zelle or PayPal may make the most sense. If you're working in an industry particularly vulnerable to these scams, like finance or the energy sector, extra caution may be necessary.

The FBI recommends against downloading applications or making payments directly on sites linked to QR codes since they could potentially be malicious. Instead, navigate to the URL manually so that a payment can be made confidently on a trusted, known website, the agency recommends.

Other scams include phony QR code scanning applications that are actually malicious software, which can allow malware to be downloaded on your phone. Note that the camera app on most leading smartphones has a QR code scanning capability built in, so there's generally no need to download an additional app.

Smartphones may be even more vulnerable to malicious phishing attempts because of the sheer amount of personal information stored on them. Hackers are constantly seeking out vulnerabilities in software to exploit and steal personal information. By keeping your software up to date, you'll ensure that you have the latest version of your phone's operating system, which is the least vulnerable to scams.

Another safeguard is multifactor authentication, which provides an additional layer of security that can thwart all types of unauthorized users, including QR scammers. This feature is available for all leading email platforms, social networks, and reputable banks. It requires the user to confirm their identity by logging in with a code or prompt on a separate device after entering the password.

A criminal trying to steal personal information through a QR code may get login information, but they won't be able to get past the multifactor authentication unless they also have access to the authenticating device.

Story editing by Alizah Salario. Additional editing by Elisa Huang. Copy editing by Tim Bruns. Photo selection by Clarese Moller.