The convenience of using QR codes for payments while travelling is undeniable. But cybersecurity experts at Kaspersky are sounding the alarm: scammers are increasingly using misleading codes to trick tourists into sending money to the wrong account.
The Anatomy of a QR Code Scam
The
scheme, sometimes called 'quishing' (QR phishing), is alarmingly simple and effective. Scammers identify high-traffic tourist spots like restaurants, parking meters, cafes, or ticket counters that use QR codes for payment. They then print their own malicious QR code on a sticker and physically place it over the legitimate one. An unsuspecting tourist, often in a hurry, scans the code expecting to pay the merchant. Instead, their phone is directed to a fraudulent payment page or directly initiates a transfer to the scammer's account. Because the transaction seems to work, the fraud may not be discovered until much later.
Why Tourists Are Ideal Targets
Cybercriminals specifically target travellers for several reasons. Tourists are often distracted, navigating unfamiliar surroundings, and possibly dealing with a language barrier. This makes them less likely to scrutinize a payment process. As Lead Security Researcher Noushin Shabab from Kaspersky’s Global Research and Analysis Team (GReAT) notes, 'Travel is a time when people naturally focus on discovering new places, not on cybersecurity'. This relaxed mindset is precisely what scammers exploit. They rely on the victim's assumption of trust and the perceived convenience of the technology to execute the theft quickly and quietly.
Kaspersky's Specific Warning
In a recent advisory, Kaspersky highlighted the growing threat for tourists, particularly those visiting countries with widespread digital payment adoption. For instance, they identified fraud targeting Indonesia's national QRIS payment system as a key risk. This system is used by countless shops, restaurants, and vendors across the country, making it a prime target. The firm warns that scammers replace these codes to either redirect payments or lead users to phishing sites designed to steal their financial and personal information. This isn't just about one lost payment; it can lead to compromised bank accounts and broader identity theft.
How to Spot a Fraudulent QR Code
Vigilance is your best defence. Before scanning any QR code, take a moment to physically inspect it. Look for signs of tampering, such as a sticker placed over another code. Check if the corners are peeling or if the finish of the sticker looks different from the sign it's on. When you scan the code, most smartphones will show you a preview of the URL or payment destination before you proceed. Read this carefully. Does the name match the merchant you are trying to pay? If the URL is shortened or looks like a random string of characters, it is a major red flag.
Simple Steps for Safer Payments
Kaspersky and other security experts recommend a multi-layered approach to protection. First, always confirm the payment details on your screen match the merchant. If possible, ask the staff to verify their payment username or company name. Be extremely cautious when using public Wi-Fi for financial transactions; using your mobile data is a safer option. For booking flights and hotels, navigate directly to official websites or apps rather than clicking links in unsolicited emails or messages. Finally, enable transaction alerts on your banking apps. This ensures you are immediately notified of any payment, allowing you to spot and report fraudulent activity right away.
What to Do If You Become a Victim
If you suspect you've scanned a malicious code and made a payment, act quickly. Contact your bank or credit card provider immediately to report the fraudulent transaction and have them block your card if necessary. Change the passwords for any accounts, especially financial or email, that you may have accessed after scanning the code. You should also report the incident to the establishment where the fake QR code was located so they can remove it and warn others. Taking these steps can help mitigate the financial damage and prevent the scammers from causing further harm.
