AG Shares FBI Warning About Malicious QR Codes

• Take you to a “phishing website.” Scammers create sites that look convincing and ask for personal information. Any information you provide on this site goes to the scammer.
• Be used to download malicious software such as malware, ransomware, and trojans. These viruses can spy on you, steal sensitive information or files (like photos or videos), or even encrypt your device until you pay a ransom.
• Be programmed to open apps on your device. It could open financial apps, social media accounts, and email accounts. It can compose and send messages to your contacts using your email or social media accounts.
• Be used in phishing emails. QR codes are not picked up by security software, unlike attachments and links.

“QR codes are widely used in so many different ways that it’s not surprising bad actors would develop the means to use them to scam us,” Nessel said. “This is another area where we need to protect our personal and financial information by practicing caution when using these convenient codes.”

The FBI offers several ways QR code users can protect themselves:

• Do not scan a code if it is on a sticker, looks like it has been replaced, or is covered up.
• After scanning the code, see if the URL you are taken to is a secure one that begins with “https.”
• Download a QR Code Scanner app that can help you recognize a suspicious code.
• Rather than scanning a code that will take you to a specific website, if possible, just type in the URL for that website.

Anyone who uses QR codes should be aware of the potential risks and always be on the lookout for malicious codes. Typically, victims of such scams do not become aware of the scam until the monetary theft is perpetrated, which can occur a considerable time after the identity theft, at which point it can be difficult to pinpoint how their information was compromised.