Fake QR codes on parking machines: 5 tips to protect against "quishing"
Digital payment methods are becoming increasingly popular for parking - and criminals are taking advantage of this. Their target: the practical QR codes on parking machines, which drivers can use to pay quickly and easily. ParkRaum-Management PRM GmbH from Erlangen explains how drivers can protect themselves against "quishing" attacks.
There are currently an increasing number of reports in Germany about fake QR codes on parking machines. Fraudsters are sticking manipulated stickers over the genuine QR codes of parking apps or the operator's payment website. When drivers scan these codes, they are taken to deceptively genuine-looking phishing pages. There, sensitive data is tapped or payments are redirected to the perpetrators. This is known as "quishing" - a combination of "QR code" and "phishing".
"Quishing at parking machines is a problem that we take very seriously as a digital parking management company," explains Marko Guljelmovic, Managing Director of ParkRaum-Management PRM GmbH. "However, drivers can arm themselves very well against it if they know what to look out for."
PRM therefore gives drivers five practical tips on how they can protect themselves against manipulated QR codes:
- Keep an eye out when scanning: The QR code may be attached individually as a sticker. If a code looks suspicious - e.g. because it clearly covers other writing - parkers should refrain from scanning it.
- Check web addresses: To check whether the URL of the payment website is correct and trustworthy (e.g. https:// with the official domain of the operator), drivers are best advised to use the preview function of their smartphone when scanning the QR code. Fraudulent websites often use slightly modified addresses.
- Checkwebsite content: If the QR code and URL look trustworthy, check the website for suspicious spellings of words ("ü" becomes "ue") or strange wording.
- Be careful with personal data: If the website requests unusual information such as a bank account PIN or password, cancel the process immediately.
- Use alternative payment methods: If drivers are unsure, in most cases they can also pay directly via a parking app or with cash or card.
An important note on parking apps: The regular QR codes of the apps on the parking machines basically never lead to payment websites. The real QR code only leads to the app (if the app has already been downloaded) or to the download in the Apple App Store or Google Play Store. However, the apps can also simply be downloaded without a QR code and the parking spaces can be found manually by entering the zone code. This means that parking apps can still be used safely.
If you come across a suspicious QR code on a parking machine, it is best to inform other drivers and report the incident to the operator or the police. If the QR code has been scanned and sensitive information such as bank details have been entered on a suspicious website, those affected should inform their bank immediately and report the incident to the police.
