Scammers are increasingly leveraging QR codes to trick individuals into visiting malicious websites and downloading fraudulent applications, according to reports from cybersecurity agencies. The UK's National Cyber Security Centre (NCSC) has noted a surge in phishing emails that use QR codes to obscure links to harmful sites, a tactic Microsoft identified as the fastest-growing scam technique targeting emails, with 18.7 million cases recorded in March.
Professor Filipo Sharevski of DePaul University in Chicago, who has researched the malicious use of QR codes, explained that these seemingly innocuous black and white squares allow scam links to bypass spam filters that might otherwise flag a direct URL. "A URL embedded in a message might be filtered out as spam," Sharevski noted.
Furthermore, QR codes can make it easier for criminals to conceal the true destination of a link. Even when a phone offers a preview of the link before it is scanned, it is often shortened or disguised, making it difficult for users to identify the intended website.
Criminals also benefit from the inherent trust people place in QR codes. "We don't question our boarding pass on our phone, we don't question our concert ticket," Sharevski said, referring to experiments his team conducted by placing QR codes on his university campus and in workplaces. He added that while people have become more wary of suspicious phone calls or emails, they have not yet developed the same level of caution for QR codes. "Our phone rings… we abandon that. We get an email, and we abandon that…but these QR codes, we have no reason to suspect them."
One documented instance involved Les Howard, who downloaded a parking app via a QR code. This action led to scammers establishing a monthly subscription of £60 from his account. 