Malicious QR Code: The Scan That Opens Your Wallet

The modern world often looks like a puzzle of small black and white squares. They are everywhere: on restaurant menus, on street light poles, on packages that arrived by mail, and even on tombstones in cemeteries. The QR Code (Quick Response Code), originally invented for the Japanese automotive industry, has enjoyed a meteoric resurgence during the COVID-19 pandemic. It has become the primary bridge between the physical world and the digital space. But within this convenience, within the rapid 'click' and instinctive scan, hides one of the most sophisticated and developing threats in the world of digital fraud: 'Quishing' (QR Phishing).

In previous chapters, we covered fake text messages and emails. There, the trap is usually visible to those who know how to look for it – a strange sender address or broken language. With a QR Code, the problem is that the human eye is unable to read the code. For us, it is just a random graphic pattern. We place complete trust in our mobile phone to decode the destination for us, and often, that destination may be the gateway to financial loss.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

Ronen, a software engineer, is considered by his family to be tech-savvy. He is the one who sets up the routers, installs antivirus for his parents, and warns everyone not to click on suspicious links in SMS messages. But one day, in the afternoon, even Ronen's defenses were put to the test.

He was rushing to an important meeting in a busy area. After an exhaustive search, he finally found an open parking spot. On the parking meter was a large sticker with a municipal emblem and branding that looked official. 'Parked? Scan and pay with a click – no need for an app,' it read next to a prominent QR code.

'Great,' Ronen thought, 'saves me time.' He took out his phone, scanned the code, and within seconds, a site that looked like an official payment portal opened in his browser. The colors were correct and the logo was in place. He was asked to enter the vehicle number and the desired duration. He entered his credit card details, clicked 'Confirm Payment,' and received a message on the screen: 'Payment completed successfully. Have a pleasant parking experience.'

Ronen continued to his meeting with a clear head. He did not know that in this scenario, his credit card details were transferred to an external server. He also did not know that the sticker he scanned was placed on the meter by a malicious actor who covered the original code.

The awakening came in the evening. Ronen noticed notifications from his credit card issuer regarding transactions for significant amounts made on foreign sites he had never heard of. He logged into his bank app and saw a list of pending charges. He remembered the parking meter and that scan, which had seemed so innocent and convenient.

When he contacted the customer service department of the credit card issuer, the representative asked him: 'Did you provide your card details on any site recently?'. 'Only at the parking meter,' Ronen answered. 'We have seen many such cases recently,' the representative replied. 'You may have scanned a fake code.'

The Anatomy of QR Fraud: Why Does It Work?

To understand why the QR code has become an effective tool in the hands of scammers, we must understand the psychology behind the scan. Unlike a text-based link (URL) where we can examine the letters, a QR code is a 'black box.' The average user does not know where they are being taken until after the action has already been performed.

These scams often exploit several key factors:

1. Trust in the Physical Location

There is a tendency to trust physical objects. If a person sees a QR code printed on a sign inside a recognized institution, on a restaurant table, or on an official payment machine, they assume the code belongs to the property owner. The thought is: 'If the sticker is here, it is safe.' Malicious actors may go to public places and paste a malicious code over the legitimate code.

2. Bypassing Digital Defense Mechanisms

Email security systems know how to scan links and identify known phishing sites. However, a QR code is an image. Some security software may have difficulty 'reading' the image and analyzing the link hidden within it as efficiently as they scan text, which allows the message to penetrate security filters.

3. Sense of Urgency and Convenience

QR codes are often placed in places where people are in a hurry: parking payments, menu scanning, or quick registration. In a state of haste, critical thinking may decline, and the user might scan without thoroughly examining the landing page that opens.

Common Types of QR Scams: A Guide to Spotting Landmines

QR scams are not limited to stickers on the street. Over the years, during professional work, diverse methods have been observed:

The 'Pending Package' Scam - QR Version

In this scenario, a person receives a physical letter in their mailbox that looks like it was sent from a well-known courier company. The letter states that an attempt was made to deliver a package and that to coordinate a new time or pay a nominal handling fee, one must scan the code. The physical letter provides a sense of reliability, and the scan can lead to a fake payment page.

Scams at Electric Vehicle Charging Stations

Many charging stations are operated by scanning a QR code. Malicious actors may stick fake codes on the stations, leading to a site where the driver is asked to enter credit card details. In such a case, the driver may lose their credit card details without the station actually being activated.

'Special Discount' in Restaurants and Cafes

On restaurant tables, a code might appear that promises a significant discount in exchange for signing up for a customer club. The scan might lead to a page requesting personal details or downloading an app that may contain malicious components that siphon information from the mobile device.

Legal Aspects: Examining Liability in Case of Fraud

When a person discovers that their account has been charged following the scan of a malicious QR code, the legal question arises regarding the possibilities of reclaiming the funds. In Israel, this issue is regulated under the Payment Services Law, 2019.

The law grants consumer protection in the event of 'unauthorized use' of a payment instrument. As a general rule, if transactions were performed without authorization, the customer's liability is limited to the amounts stipulated by law, and the claim for the restitution of the remaining damages from the payment institution can be examined. The legal discussion often focuses on the question of whether the customer acted with fraudulent intent or gross negligence.

The Question of 'Gross Negligence' in QR Scanning

An argument might be raised that scanning a code pasted on the street and entering details constitutes gross negligence. Conversely, in a legal analysis of these cases, it can be argued that when the impersonation is sophisticated and the code is placed in a public location that grants it a presumption of legitimacy, this should not be seen as gross negligence that voids the law's protection.

In many cases, the legal approach tends to protect the consumer, as 'gross negligence' is a high threshold that the payment institution must prove. In circumstances where a person has fallen victim to a sophisticated act of fraud, the chances of recovering the funds can be examined according to the circumstances of the case.

Liability of the Property Owner or Local Authority

Another legal issue is the liability of the entity in whose territory or on whose facilities the code was pasted. It is possible to examine whether an entity operating facilities in the public space, which fails to remove malicious stickers over time, breached its duty of care. These are legal questions that can be analyzed in accordance with general tort law.

Defense Tactics: Scanning Hygiene

One can continue to use QR codes while taking safety precautions:

1. Physical Inspection

Before scanning a code in a public place, it is recommended to verify that it is not a sticker pasted over another code. If it seems that the code is not an integral part of the sign or device, it is worth avoiding scanning it.

2. Examining the URL

Most devices display a preview of the website address before opening it. One should examine the address and verify that it matches the expected official body and that it is not a shortened or suspicious address.

3. Downloading Apps Only from Official Sources

It is recommended to avoid downloading apps directly via a QR code. It is better to search for the app manually in the official app stores, which perform security checks on the content uploaded to them.

4. Using Two-Factor Authentication (2FA)

Enabling two-factor authentication provides an additional layer of protection. The verification code sent to the mobile is the final barrier, and it should not be entered on a site opened via a QR code unless the user initiated the action on a recognized and secure site.

Legal Aspect: Summary of Conduct with Payment Institutions

During years of professional work, many cases of victims who feel discomfort arise. It is important to understand that this is the activity of sophisticated criminal elements.

From a legal perspective, attention should be paid to the following points:

• Reporting Obligation: Upon discovery of the fraud, the credit card company or bank must be notified without delay. Early notification may reduce the customer's liability.
• Examining the Right to a Refund: According to the law, in cases of unauthorized use, there is a framework that allows requesting the restitution of transaction amounts, subject to the examination of the circumstances of the event by the paying entity.
• Burden of Proof: The burden of proving 'gross negligence' is usually placed on the payment entity. The mere act of scanning is not enough to establish this claim.

Red Flags

• The code looks like a sticker pasted over an existing sign, parking facility, or menu.
• The scan leads to a page requesting urgent entry of credit card details or sensitive personal information.
• The website address does not match the official website of the relevant entity.
• The code arrived as part of an unexpected physical outreach to the mailbox.
• The scan causes the device to request unusual access permissions to contacts or messages.

What to Do Immediately (Emergency Steps)

1. Blocking Payment Instruments: Immediate contact with the credit card company or bank to cancel or freeze the card whose details were exposed.
2. Documentation: Photographing the physical code and its location, as well as a screenshot of the website address that opened.
3. Changing Passwords: If login details were entered, passwords for the relevant accounts must be changed immediately.
4. Reporting to Authorities: Filing a complaint with the Israel Police. This action is essential for exhausting rights against payment institutions.
5. Device Security Check: If a file was downloaded, it is recommended to perform a professional malware scan on the mobile device.

Legal Aspect – Abstract

The Payment Services Law, 2019, forms the infrastructure for consumer protection in these cases. In situations of QR fraud, the limitation of customer liability can be examined. Since payment institutions may sometimes examine liability in a restrictive manner, it is recommended, in cases of significant damage, to examine the legal options available to the consumer. Although technology changes, the principles of consumer protection are intended to provide a response in situations where a person is harmed by sophisticated fraudulent acts.