Malicious QR codes may steal your money

The Federal Bureau of Investigation (FBI) warned Americans that cybercriminals are using maliciously crafted Quick Response (QR) codes to steal their credentials and financial information. This warning was issued as a public service announcement published on the FBI’s Internet Crime Complaint Center (IC3) in February.

“Cybercriminals are tampering with QR codes to redirect victims to malicious sites that steal login and financial information,” the federal law enforcement agency said.

The FBI said crooks are switching legitimate QR codes used by businesses for payment purposes to redirect potential victims to malicious websites designed to steal their personal and financial information, install malware on their devices, or divert their payments to accounts under their control.

After the victims scan what looks like legitimate codes, they get sent to attackers’ phishing sites, where they are prompted to enter their login and financial info. Once entered, it gets sent to the cybercriminals who can use it to steal money using hijacked banking accounts.

“While QR codes are not malicious in nature, it is important to practice caution when entering financial information as well as providing payment through a site navigated to through a QR code,” the FBI shared. “Law enforcement can’t guarantee the recovery of lost funds after transfer.”


The FBI advised Americans to pay attention to the URL they’re sent to after scanning a QR code. They advised being cautious when entering in data after scanning a QR code and to make certain that physical QR codes haven’t been covered with malicious ones.

Consumers should also avoid installing apps via QR codes or installing QR code scanners. Instead, utilize the one that is installed on your phone – this may even be your phone’s camera. Last but not least, it is important to enter the URLs by hand when making payments instead of scanning a QR code that could be set up to redirect you to a malicious site.

The FBI issued another PSA focused on QR code risks in November, alerting people that victims of various fraud schemes are increasingly asked by criminals to use QR codes and cryptocurrency ATMs to hinder efforts to recover their financial losses.

As evidenced by a recent phishing campaign that targeted German e-banking users, threat actors use QR codes instead of buttons in spam emails to make their attacks harder to detect by security software and successfully redirect victims to phishing sites.

Victims successfully redirected to the phishing landing pages were asked to enter their bank location, code, user names and PINs.