New online scam - QR scam

[dcontesti]

The latest scam on unsuspecting folk:

https://globalnews.ca/news/10150582/qr-code-scam-calgary-family/

[ericgeater]

Thanks for sharing this, Ms. Contesti!  The article mentions Canadian Shield, which makes me wonder what other public DNS resolvers people use in addition to Canadian Shield.

[nkeaton]

@ericheater We have been aware of quishing for a very long time. We do not worry about them on E-mails as we have ours as text based to keep users from clicking on links. So we do not worry about DNS resolution in that context. The biggest issue with quishing that we have found is people having no way to really analyze it before scanning. One of the biggest scams that we see with quishing is in public areas such as parking lots. The scammers just put their QR code on a sticker over the legitimate one for parking payment. Never seen anyone do DNS inspection from their phone.

[dcontesti]

@ericgeater

Some of the AV companies have protection for QR scams (we use McAfee's which uses an AI scam detector).

I use Canadian Shield on personal device (it's free, easy to install and works)  

others?

d

[dcontesti]

@nkeaton @ericgeater 

We recommend that folks convert any QR code to text prior to scanning.

Converting the code is quite simple and can be done with any mobile device.  There are several ways but the simplest: 

1. Open Camera: Launch the built-in camera app on your iPhone or Android phone.
2. Point & Scan: Point your camera at the QR code; your phone should automatically recognize it and show a notification.
3. Tap Notification: Tap the notification to open the decoded text, website link, or contact info. 

OR you can use a decoder such as imagetotext or qr code monkey 

Installing Canadian Shield or using one of the AV providers will also assist normal users.

d