Hackers stole $ 20,000 from a woman through a fake QR code

According to the Singaporean media outlet The Straits Times, a 60-year-old woman lost $ 20,000 when she scanned a fake QR code with her smartphone. The victim saw a sticker with it on the front door of a Bubble Tea cafe. The ad called for an online survey and a free cup of tea with milk. As it turned out later, the cafe had never held such a promotion for customers.

The QR code directed the woman to download a third-party application. The victim installed it and filled out a questionnaire there. The mobile application contained a full-fledged backdoor — the attackers remotely accessed the victim’s smartphone.

Using the screen recording function, the fraudsters managed to spy on the woman’s online banking pin. Late at night, when the victim was already asleep, the hackers remotely unlocked the smartphone and stole $ 20,000 from the victim’s account.

Cybersecurity experts note that the distribution of fake QR codes under the guise of well-known local brands inspires consumer confidence. They advise checking announcements of promotions and discounts, and in case of suspicion, contacting customer service and the police.

A similar type of fraud is flourishing in the United States. Recently, it became known about a victim from San Francisco who paid a fine for an alleged parking violation. The fraudsters stuck a receipt to the windshield of the victim’s car. The document contained a QR code to pay the fine on a phishing website that imitated the SFMTA (San Francisco Municipal Transportation Agency) resource.

Interestingly, the receipt that the victim received on May 4 was dated May 5, which was the reason for suspicion.

Further investigation revealed that the fake website used Square’s web payment form to process fraudulent transactions, and the «fine» paid by the victim ended up in the attackers' pockets.