India has witnessed a surge in QR code scams as digital payments become increasingly popular, with over 20,000 cases reported since 2017, according to a recent report. Between 2017 and May 31, 2023, Bengaluru alone registered approximately 20,662 cases, constituting 41% of all cases related to QR codes, malicious links, or debit/credit card fraud.
The report, released by Palo Alto Networks, highlights the challenges posed by visually similar QR codes, making it difficult to distinguish genuine ones from fraudulent ones. Attackers exploit this by replacing legitimate QR codes with their own, potentially compromising a business's website.
When unsuspecting individuals scan these altered codes, they are redirected to phishing URLs, where cybercriminals can request user credentials, gaining access to email or social media accounts. Alternatively, users may be led to an untrustworthy app store, prompting them to download malicious applications containing viruses, spyware, trojans, or other forms of malware. This can lead to data theft, privacy breaches, ransomware attacks, and, in some cases, crypto-mining.
Vicky Ray, Principal Researcher at Palo Alto Networks, emphasized the prevalence of QR code-related scams, particularly in establishments such as bars, restaurants, lounges, shops, and clubs. Attackers surreptitiously replace QR codes, potentially resulting in unauthorized UPI (United Payment Interface) payments and financial harm.
The United Payment Interface recently exceeded 10 billion monthly transactions in August, with a transaction value of Rs 15.18 trillion ($204.77 billion), underscoring the growing importance of digital payments in India.
ALSO READ: Apple cuts ties with X: No more customer support for Musk’s platform
The report also highlighted another common threat tactic among cybercriminals: the use of "evil twin" or hotspot honeypots. In this scenario, threat actors establish insecure Wi-Fi networks that entice users with free internet access upon scanning a QR code. Once connected, hackers intercept and eavesdrop on transmitted data, stealing personal or confidential business information, online banking credentials, and credit card details.
With the rise of hybrid working globally, individuals are urged to exercise caution and connect only to secure Wi-Fi networks to avoid falling victim to these cyber traps. The report serves as a reminder of the need for enhanced cybersecurity awareness and vigilance in an increasingly digital landscape.
ALSO READ: ChatGPT-4's personal narrative generation holds potential for more effective psychotherapy: Study
Inputs from IANS
