To Scan or Not to Scan: 4 Safety Tips for Using QR Codes

Think before you scan! How to spot the danger signs when scanning QR codes.

By Laura Mellett

 

From parking signs to billboards and TV ads to restaurant menus, those little black-and-white squares known commonly as “QR codes” are everywhere now.

And although they are great for providing quick access to product information and a contactless user experience, it's important to be aware of the potential risks associated with scanning them — from phishing scams to malware attacks. Criminals can direct users to fraudulent websites or prompt them to download apps that can reveal their location.

"They can be fast and convenient and arouse curiosity," says Alan Wickman, Information Security Analyst at TCDRS. "Threat actors are aware of that, so you should be sure to proceed in a secure manner."

Here are the steps you can take to decide if a QR code is safe:

• Consider the source
  A QR code is more likely to be safe if it comes from a reputable source. It is best to proceed cautiously if you find a QR code in an unsolicited email or on a random website. Criminals have been known to place stickers over legitimate QR codes in public places, such as bus stops. Also, avoid using QR codes to pay bills. There are many other payment methods that are less susceptible to fraud.

• Check the destination
  If the QR code directs you to a website, make sure the URL is spelled correctly and begins with “https”. Be wary of websites that have a different URL than what was expected or if the website is not using a valid SSL certificate (click the lock icon next to the URL in your browser bar). If you scan a QR code and the URL looks cryptic, the website requires a login or the site is unrelated to what you scanned, close out of your browser.

• Use a reputable QR code reader
  Your smartphone likely has a built-in QR code reader that can be used for this purpose. Avoid downloading third-party apps to make scans. Also, when scanning a QR code, be sure to look at the preview of the destination. This feature gives you a chance to review the URL and decide if the QR code is safe.

• Be cautious about giving out personal information or downloading apps
  Many legitimate websites will require you to enter personal information. Still, it is important to know what information is being requested and if it is necessary to provide it. Do not download apps from a QR code. Instead, use your phone's app store.

Just like hyperlinks, QR codes can be very helpful. Just remember that it’s always best to be cautious when clicking links and scanning codes.

“The personal cost of not slowing down or remembering to apply authenticity checks and common-sense security can easily be greater than the benefits of automatically clicking,” Alan says.

Personal Finance