Learn How to Spot and Avoid QR Code Scams

While QR codes can be convenient, scammers are now using them in a new type of phishing attack called “quishing” (a combination of “QR” and “phishing”). Learn more about this scam and how to protect yourself.

What Is a Quishing Scam?

Quishing scams use malicious QR codes that, once scanned, lead unsuspecting victims to fraudulent websites designed to steal personal information or install harmful malware on their devices. These deceptive QR codes can be found in various places, including emails, text messages, flyers, posters, or even seemingly trustworthy websites.

Example of the Scam

Sally receives an email that appears to be from her financial institution, but she notices grammatical errors and a suspicious sender address. Scanning the QR code leads to a website resembling her financial institution’s login page, but it loads slowly with distorted images, confirming her suspicion of a quishing scam.

Tips for Protecting Yourself

• Exercise caution. Don’t scan a QR code in an email, text, or personal message that you weren’t expecting.
• Double-check the URL. Before scanning, try previewing the QR code’s destination URL. Be cautious if it seems suspicious or unfamiliar.
• Protect your devices. Protect your device and accounts. Keep the operating system on your devices updated.
• Protect your personal information. Never share sensitive personal or financial information after scanning a QR code unless you are certain it’s from a trusted source.

If You’ve Been Scammed

• Contact us. If your account information has been compromised or you believe you’ve mistakenly paid a scammer, let TVFCU know.
• Change your passwords. If you entered any passwords after scanning a malicious QR code, change them immediately on all accounts where you use the same or similar passwords. Create strong passwords at least 12 characters long, including a mix of uppercase and lowercase letters, numbers, and symbols.
• Enable multifactor authentication (MFA) whenever possible for added security.
• Scan your device for malware. Run a security scan to check for and remove any malware that may have been installed.
• Report the scam. Contact the Federal Trade Commission (FTC) and Internet Crime Complaint Center (IC3). Related links are below.

Related links:
FTC https://reportfraud.ftc.gov/
IC3 https://www.ic3.gov/
TVFCU https://www.tvfcu.com/about-us/contact-us.html