Dive Brief:
- When Gettysburg, Pennsylvania, alerted businesses June 10 to a parking lot scam, it was a reminder that facilities are vulnerable to quishing – the fraudulent use of QR codes.
- Scammers were collecting people’s financial information by sticking QR codes onto parking meters and inside a municipal garage and directing drivers to scan the codes to make parking payments.
- "The Gettysburg Parking Department does not use QR codes [for drivers] to pay for parking," the municipal government said in an announcement about a rise in this type of scam, local news sources reported.
Dive Insight:
Quishing, also known as QR code phishing, is often used in email or website scams but scammers are using it in physical spaces as well, the U.S. Postal Service says in a February alert.
“Scammers post physical images of QR codes in a high traffic location [that] takes you to a scammer’s website … where the scammer lures you into providing personal or financial information,” the Postal Service says.
Widely available software programs like Adobe Express and Canva make printing QR codes simple. That gives scammers an easy way to create official-looking codes that can be placed on parking turnstiles and elsewhere on property premises.
“Signs, posters, flyers, or other physical locations” are quishing targets, the Postal Service says.
Unlike with URLs in online scams, people can’t hover over the code to look for telltale signs of fraud, like slight variances in website names.
“It’s just an image,” Dave Hatter, a cybersecurity specialist, says in a news report by WKRC in Cincinnati. “You would literally have to scan it to test it.”
In the Gettysburg case, people who scanned the code were taken to a fake parking website, where they were asked for payment information.
