Fraudsters use manipulated QR codes to obtain money or personal data. They paste over genuine codes on car park ticket machines and charging points or forge bank letters. The consumer advice centres warn of the increasing danger of so-called ‘quishing’ - a combination of ‘QR code’ and ‘phishing’.
How does the scam work?
Criminals place fake QR codes in emails, letters or in public spaces. Anyone who scans them ends up on deceptively genuine but fraudulent websites - often banking portals - where access data is tapped. The State Criminal Police Office of Lower Saxony reports that victims are guided through various processes until criminals gain access to their online banking. Personal data is also the target of such attacks.
How to protect yourself:
✔ Do not scan QR codes without thinking
✔ Contact the bank or company directly
✔ Be careful with impersonal messages
✔ Be suspicious if QR codes appear to be pasted over
✔ Check the details of parking tickets with a QR code
Manipulated QR codes are increasingly appearing in places where payments are supposed to be made quickly, such as at car park ticket machines or e-charging stations. In Düsseldorf, fraudsters lured passengers with a fake prize draw using a QR code. In Berlin, fake parking tickets with fake payment links were attached to cars.
So far, the fraud has often been recognised in time - at least in Lower Saxony, according to the LKA, there has not yet been any financial damage. Nevertheless, anyone who falls victim to a QR code scam should inform their bank and the police immediately.