Scammers are leveraging readily available personal data to create sophisticated phishing attacks, often using QR codes in healthcare environments to target individuals, particularly Medicare beneficiaries. These scams, sometimes referred to as "quishing," exploit the growing normalization of QR codes for check-ins, payments, and information access in doctors' offices, pharmacies, and hospitals.
Criminals can obtain personal details such as full names, home addresses, phone numbers, and approximate ages from data brokers and people-search websites. This information is then used to personalize scam messages, making them appear legitimate. For example, a fake Medicare notice containing an individual's name and address is more likely to be trusted than a generic message.
Exploiting Familiarity and Trust
QR codes have become a common feature in healthcare settings, increasing their perceived legitimacy. Doctors' offices use them for patient check-ins, pharmacies for prescription information, and hospitals for parking payments. Scammers place fraudulent QR codes, often as stickers overlaid on legitimate ones, or include them in deceptive mailings. When scanned, these codes can direct users to fake websites designed to mimic official portals for insurers, pharmacies, or medical providers.
These fake sites then solicit sensitive information, including Medicare numbers, patient portal login credentials, Social Security numbers, credit card details, and other personally identifiable information. The deceptive nature of QR codes, where the destination is not immediately visible, aids scammers in their efforts.
Real-World Examples
Reported incidents highlight the prevalence and impact of these scams. One example involved a Medicare beneficiary who received a letter resembling official plan correspondence, directing them to scan a QR code for an Annual Notice of Change. The QR code led to a fraudulent web address. In another instance, a fake QR code sticker on a parking payment machine at Totnes Community Hospital in the U.K. resulted in a victim losing over £146. Similar counterfeit QR codes have been documented by law enforcement in California, placed on parking meters within medical facilities.
Protecting Against QR Code Scams
Consumers can take several steps to protect themselves from these evolving scams:
- Preview Links: Before opening a QR code destination, check the displayed web address for unfamiliar, shortened, misspelled, or altered domains.
- Verify Codes: If instructed to scan a QR code by office staff or on paperwork, ask for confirmation from the office. Do not automatically trust codes found on signs or payment machines.
- Inspect for Tampering: Look for signs that a QR code sticker may have been placed over another, such as crooked placement, peeling edges, or a mismatch with the surrounding material.
- Go Directly to the Source: When in doubt, navigate directly to the official website of the healthcare provider, insurer, or Medicare by typing the address into your browser or using a trusted official app, rather than relying on QR codes in mailings or on notices.
- Enable Two-Factor Authentication: Activate 2FA for patient portals, financial accounts, and email to add an extra layer of security.
- Maintain Updates: Keep phone operating systems, browsers, and security software up-to-date to protect against malicious websites and downloads.
- Report Suspicious Codes: Inform office staff or hospital security if a QR code appears suspicious. Reports can also be made to the Federal Trade Commission at ReportFraud.ftc.gov.
Limiting Personal Data Exposure
In addition to spotting fraudulent QR codes, individuals can reduce their vulnerability by limiting the amount of personal information available online. Data brokers and people-search websites often compile and sell personal details. Requesting the removal of information from these sites, either personally or through a data removal service, can make it harder for scammers to create convincing, personalized attacks.