Spanish police have warned residents and tourists against scanning QR codes found on discarded bags after criminals began leaving fake cryptocurrency purchase documents around the town of Montgat in an attempt to infect people’s phones with malicious software.
Police in Spain have issued a warning over a new scam in which criminals leave bags containing fake cryptocurrency purchase documents in public places, hoping passers-by will scan an accompanying QR code out of curiosity and unwittingly infect their phones with malware. The tactic has been recorded in Montgat, a town in northeastern Spain, where plastic bags containing counterfeit paperwork for buying cryptocurrency were discovered discarded around the area. Authorities have urged both residents and tourists not to scan QR codes from unfamiliar sources, whether found in the street, sent to a home address or received by email.
How the scam works
According to police, the fraud relies on fake invoices bearing QR codes that appear to relate to a cryptocurrency purchase. These are left on the street or sent to random addresses, in the hope that whoever finds them will scan the code out of curiosity, believing they may have stumbled upon a forgotten Bitcoin purchase or an unclaimed digital wallet. Cybersecurity experts refer to this type of fraud as “quishing,” a form of QR code phishing in which victims are tricked into scanning a malicious code rather than clicking a suspicious link. Once scanned, the code can direct victims to a fake website designed to harvest personal information, login credentials or cryptocurrency wallet details, or prompt them to download software that gives criminals direct access to their device.
The damage that follows
Once cybercriminals gain access to a device in this way, the consequences can be significant. Malware installed through scams of this kind can be used to steal banking credentials, passwords, authentication codes, photographs, contacts and other sensitive information stored on a smartphone, as well as granting access to email accounts and confidential documents. Given how much personal and financial information is typically stored on a modern phone, security experts warn that the damage from a successful attack can extend well beyond the initial scam itself.
Why criminals are turning to QR codes
Cybersecurity experts note that criminals have increasingly turned to QR codes as a tool for phishing precisely because people tend to trust them more readily than traditional web links. This particular scam is far from an isolated case: similar QR code frauds have previously targeted parking payment machines, restaurant menus, parcel delivery notices and public information posters, in each case with a fake code placed directly over a genuine one to catch out unsuspecting users. Officials have described these scams as having “no borders,” noting that similar tactics have been spreading rapidly around the world.
How to protect yourself
Cybersecurity experts advise against scanning any QR code from an unknown or suspicious source, particularly ones found on discarded objects, unfamiliar stickers or unsolicited letters. Before opening a link generated by a QR code, users are advised to check the destination web address, since many modern smartphones will display the target URL before the page itself loads, giving people a chance to spot anything suspicious. Keeping a smartphone’s operating system and security software up to date is also recommended, as this can help protect against some forms of malware spread through malicious codes.
What to do if you’ve already scanned a suspicious code
Anyone who believes they may have scanned a malicious QR code is advised to disconnect their device from the internet immediately, run a security scan, and change any important passwords as a precaution. If there is a possibility that financial details have been exposed, experts recommend contacting your bank without delay. Spanish authorities are also urging residents and tourists to report any suspicious QR codes they encounter to local police, so that fraudulent materials can be identified and removed before more people fall victim to the scam.
