Kaspersky explains why we should be cautious with QR codes during Songkran

Apart from the annual ritual among family and friends, you have been reminded of physical safety precautions you should take when engaging in a water battle with loaded squirt guns and buckets of water in the streets of cities and villages. However, there are fewer cyber safety tips available when it comes to the protection of your personal data and financial accounts.

QR codes - which stand for 'quick response' - function like barcodes on steroids. They provide a quick and easy way to make e-payments, participate in surveys, subscribe to discount promotions, download useful materials, hotel check-in, access websites, and follow social media. After all, pointing a smartphone to a black square image is much easier than inputting a lengthy URL.

However, the convenience hides a serious drawback.

With regular links, a trap may be detected with the naked eye. The red flags are well-known: typos or additional characters in the web URL, a hidden redirect, unusual domain zones, and so on. However, QR codes may direct you to fake websites, download malicious applications, and unintentionally provide personal information.

“QR codes are all around us now. Not many users suspect that someone could replace a code on an official advertisement displayed in a bank, on public transportation, or at a tourist attraction. However, there were many cases of fraudulent QR codes being neatly placed over legal ones,” says Yeo Siang Tiong, General Manager for Southeast Asia at Kaspersky.

This particular case shows you how dangerous QR codes can be. A 60-year-old woman in Singapore scanned the QR code sticker on the coffee shop door to get a free cup of bubble tea. Later, it was discovered that cybercriminals had covered the sticker. The scam code included a link to a third-party Android app that she assumed would allow her to complete a survey. However, the app was malicious and she lost $20,000.

According to the NCSA, Thailand's cyber threat figures in 2023 are 114.25% higher than the previous year. The top three risks are website hacking, defacement, and fake websites.

“Thailand's digital economy remains the second largest in Southeast Asia, driven by e-commerce. Therefore, QR codes have quickly become widespread in Thailand, attributed in significant measure to track and trace system requirements in stores, restaurants, and businesses. The increase in threats in the country is notable, both in quantity and quality. We encourage people to be more cautious about unusual actions, particularly when travelling and letting down the safety net,” adds Yeo.

Because it is impractical to avoid scanning QR codes entirely, Kaspersky suggests the following:

• Check the addresses of sites that are linked inside QR codes carefully, and look for typical red flags.

• Make sure that the expected and actual content match up. For example, if the code was supposed to lead to a survey, logically there should be some kind of form with answer options. If not, close the site immediately. But even if the page arouses no suspicion, you should still be careful - it may be a high-quality fake (see the first point and read our post about how to spot a bogus site).

• Don’t download apps via QR codes. As a rule, bona fide apps can always be found on Google Play, the App Store, or any other official platform. Apps from third-party sources shouldn’t be installed in any case.

• Protect your devices with a reliable security solution. A built-in QR scanner lets you check the link buried in the maze of squares. Also, our solution blocks attempts to visit malicious sites and protects you from the profusion of other threats out there in cyberspace.