Blog

How to protect yourself from “Quishing”: Beware of fraudulent QR codes!

QR codes have become ubiquitous in our daily lives. They facilitate payments, access to information or even consult menus in restaurants. However, their popularity also makes them a prime target for cybercriminals. A recent example in Bruges, Belgium, highlighted a type of fraud called “Quishing”, where QR codes were replaced by fraudulent versions, thus diverting users’ payments.

So, how do you protect yourself from this type of threat? And why could NFC (Near Field Communication) technology be a safer alternative to QR codes? Here’s everything you need to know.

What is Quishing?

Quishing, a combination of “QR” and “Phishing”, is a scam where QR codes are altered or replaced, redirecting victims to fraudulent websites or cybercriminals’ bank accounts. This can happen anywhere: in car parks (like in Bruges), restaurants, or even at public events.

In Bruges, scammers replaced the QR codes on parking terminals with fraudulent stickers. Drivers thought they were paying for their parking, but in reality, their payments were diverted to malicious bank accounts.

Why are QR codes vulnerable?

QR codes, although useful and practical, have several vulnerabilities that make them an ideal target for fraudsters:

Ease of manipulation: A QR code can be physically replaced by another one by simply sticking a sticker on it.

Lack of visibility: Unlike a web link that you can read before clicking, a QR code does not allow you to know in advance where it will redirect you. A good way to prevent this is to put the destination URL under the QR code to inform the visitor.

Lack of built-in security: QR codes themselves do not have security mechanisms such as encryption, making their content vulnerable.

This type of fraud is not limited to Bruges. Similar attacks are found in public places, where QR codes are replaced, or on public transport.

How to avoid being tricked by fraudulent QR codes?

Here are some best practices to protect yourself against quishing and other QR code fraud:

Check the appearance of the QR code: If a QR code appears to have been added after the fact (like a poorly stuck sticker), be wary.

Use secure scanning apps: Some apps allow you to check the URL of a QR code before opening it and can alert you if there is a suspicious link.

Go directly to official websites: If in doubt, go to the website in question manually, rather than scanning a potentially fraudulent QR code.

Opt for QR codes created by professionals: QR codes are more complex than they seem. Companies like Ma Balise, a Belgian startup specializing in QR code security and NFC technology, can guarantee the security and authenticity of your QR codes.

Avoid free platforms to create your QR codes: Free services do not guarantee the security or reliability of your QR codes. You risk creating codes that are difficult to read or vulnerable to quishing attacks. Calling on experts is always recommended, even for things as simple as QR codes.

Why is NFC technology more secure than QR codes?

While QR codes are convenient, they are not the most secure. NFC technology is a more secure alternative for payments and transmitting information. Here is why NFC outperforms QR codes in terms of security:

Physical tamper-proof: Unlike QR codes, NFC tags are often embedded in physical devices and cannot be easily altered or replaced.

Short communication distance: NFC only works at very short distances (a few centimeters), greatly reducing the risks of data interception.

Frozen data: Exchanges via NFC are secure, ensuring that information cannot be easily diverted by cybercriminals. Once the NFC tag is programmed and locked, it is impossible to reprogram it to another destination.

Ease of use: No need to open a specific application. Simply hold your smartphone close to an NFC tag to make a payment or access information securely.

Ma Balise: Experts in QR codes and NFC to secure your interactions

Whether you are a company, a community or a business, Ma Balise can help you secure your QR codes and adopt NFC solutions. Specialized in the creation of secure QR codes and the implementation of NFC technology, Ma Balise guarantees reliable solutions, protecting you against attacks such as Quishing.

What to do in the event of QR code fraud?

If you think you have scanned a fraudulent QR code, react quickly:

Check your bank transactions and contact your bank immediately if suspicious payments appear.

Change your passwords if in doubt.

Report the fraud to local authorities, such as the police. In Belgium, you can also contact the FPS Economy (Federal Public Service) for additional advice.

Conclusion: Choose secure solutions to avoid Quishing

Quishing is a growing threat, but by taking a few simple precautions and adopting more secure technologies such as NFC, you can protect yourself. Remember, even for tools like QR codes, it is always best to call on professionals to ensure your safety.