Is that QR Code Legit?

QR codes have a seemingly unlimited range of uses—from directing you to a specific webpage to connecting you to a Wi-Fi hotspot. While many QR codes are safe to scan, some bad actors use them to steal sensitive information or gain access to privileged accounts.

Quishing Expeditions

Quishing, or QR code phishing, is becoming increasingly common. Much like other forms of phishing, fraudsters use QR codes to direct victims to fake websites designed to steal personally identifiable information (PII), authentication credentials, payment details, or to install malware on their devices.

Fraudulent QR codes can be placed in high traffic locations, like on a parking meter or street sign, and may also be delivered via email, text, or regular mail. In most cases, these codes lead to webpages that mimic legitimate sites, frequently impersonating government agencies or financial institutions.

Don’t Get Hooked 

Just like with other common scams, there are ways to protect yourself and your family from falling victim to quishing. Be aware of the signs:

• Before scanning a QR code, consider the source.
• Don’t automatically trust the sender, company name, or logo that accompanies the QR code or the page it directs you to. Scammers often spoof these details to appear legitimate.
• Watch for misspelled words, poor grammar, or typos within the content.
• If the QR code is in a public place, check for signs of tampering, such as stickers placed over existing codes, low print quality, or unusual placement.
• Hover over the QR code with your camera (if supported) to preview the URL. This will usually show where the link is directing you.
• Don’t scan a QR code in an email or text you aren’t expecting.
• If something seems suspicious or you aren’t sure, contact the source at a verified contact number to confirm its legitimacy.
• Be wary of tempting offers or messages that create a false sense of urgency.

HAPO will never use a QR code to request login credentials, two-factor authentication codes, or account details. If you receive a suspicious QR code claiming to be from HAPO, please contact us through a verified and trusted channel.

You can get more information on protect yourself and your family on our Fraud Prevention Page.