Quishing

New cell phone parking scam

Symbolic image.(Bild: Klaus Kreuzer)

If you use your cell phone to pay your parking fees, you should be careful. Time and again, fraudsters are pasting over the QR codes on parking machines in order to get their hands on drivers' money. 

Once again, criminals have come up with a new method to take money out of their victims' pockets. Quishing is the name of the new scam. It involves manipulating QR codes on parking machines and other public places to lure drivers to fake payment pages. The fraudsters cover the genuine QR codes with almost identical stickers that are visually almost indistinguishable. Scanning the code takes you to a website where you have to enter your license plate number, parking time and credit card details. Particularly insidious: the cell phone's security software barely recognizes these attacks, which means that the victims reveal their sensitive data unnoticed.

The first case has now come to light in Vorarlberg, as reported by the consumer protection department of the Chamber of Labor (AK): A driver scanned a manipulated QR code at a parking machine. Fortunately, he recognized in time that it was fake and directed him to a scam site. The man immediately closed the page again and contacted the AK. 

Only use official apps
Consumer protector Franz Valandro from the AK warns urgently against such evil machinations: "Criminals are exploiting the increasing popularity of QR codes to obtain sensitive data. Consumers should never scan stick-on QR codes, but instead use the official app of the respective provider."

"EasyPark", one of the largest providers of cell phone parking - represented throughout Vorarlberg - also warns on its website: Genuine QR codes are always integrated into the signs and not attached as individual stickers.

Caution is also advised in emails
However, fraud attempts with fake QR codes are not limited to parking machines. "Such codes have also been noticed in emails and letters," reports Valandro. "Fraudsters send emails or letters containing fake QR codes in the name of banks. The recipients are then supposed to scan these from the mail program on their PC or paper." It is therefore important to be vigilant here too and to check the sender carefully. Fake QR codes have even appeared on posters.