Substitution of graphic links by attackers
A QR code is just an encoded text link whose content cannot be read by the human eye before pointing the camera at it. Fraudsters exploit this to quickly swap payment addresses: the user thinks they are paying a venue's bill, while the payment goes directly to the thief's anonymous electronic wallet.
How to check a code before confirming
- carefully inspect the sticker for signs of being layered over the original menu
- check the exact website address on your smartphone screen before hitting the navigation button
- never confirm a payment or enter a phone number if an unfamiliar page opens
- use the built-in camera scanner with a preview of the full domain name