Why prevent QR code scams

Hello:

"I scanned a QR code with my mobile phone. Mr. Liu, who runs a Taobao store, went to the bank to withdraw money and found that the balance of the bank card was 0"; "What a scam. , scan the QR code sent by the seller, and the phone bill of more than 50 yuan is gone.” Recently, there have been endless complaints about QR codes. Many netizens found themselves after scanning QR codes or receiving files sent by others to install. Many of the bank cards are used, and the victimized netizens often suffer heavy losses: many thieves will rob all the bank card current deposits.

With the popularity of Weibo, WeChat, Alipay and other applications, QR codes have become a relatively common information channel. Consumers can scan a lot of useful information by pointing their mobile phone lenses at the QR code, such as the price of the product, the place of production of the product, etc. The initial use and promotion of QR codes brought a lot of convenience to consumers, but at the same time, more and more criminals took advantage of the loopholes in QR codes to commit fraud. Why have QR codes that once provided convenience to consumers now turned into traps?

Scanning codes casually can lead to money losses

According to data, QR codes are black and white graphics that use specific geometric figures to be distributed on a plane (two-dimensional direction) according to certain rules. , is a key to all information data. In modern commercial activities, a wide range of applications can be realized, such as: product anti-counterfeiting, traceability, advertising push, website links, data downloads, commodity transactions, electronic vouchers, information transfer and sharing, etc. In fact, the invention of QR codes initially provided great convenience to consumers. Consumers can get a lot of product information with just one swipe on their mobile phones.

However, many netizens have recently reported that many unexpected "situations" occurred after scanning the QR code on their mobile phones. Mr. Zou is a Taobao seller specializing in the production and installation of doors and windows. Not long ago, a strange buyer took the initiative to contact Mr. Zou, but he did not mention what product he wanted to buy. Instead, he sent a QR code in the chat message and said, "Scan it with your mobile phone WeChat and you can see the doors and windows you want to buy." Details". According to Mr. Zou's feedback to the 360 ??Online Shopping First Compensation Center, after he installed the software in the QR code, the other party asked for his mobile phone number on the grounds of "convenient contact", and then left on the pretext of going to eat. Mr. Zou didn’t pay attention at first, but an hour later, he suddenly found that he could not log in to his Wangwang account. It turned out that the password had been changed. After checking his Alipay account, he found that not only the 3,000 yuan in the balance was stolen, but also the money in Alipay account. The bound CCB card was also consumed for 2,000 yuan, and his account was linked to an Alipay account registered with an unfamiliar mobile phone number.

Not only sellers are deceived by QR codes, but buyers are also confused by QR codes. Netizen Ms. Zhang reported to reporters: She was optimistic about a piece of clothing while shopping online, and the store owner claimed that she could get more information by scanning the QR code. So she scanned the QR code and followed the instructions to install the software. However, what was waiting for her was not more detailed information but a crash on her phone. At this time, Ms. Zhang went to the store again, but the store was already offline. It was under the guidance of the scammers that Ms. Zhang scanned the QR code containing the Trojan horse virus that they had prepared in advance, causing the phone to become paralyzed.

In fact, it is not a rare phenomenon in the current market that problems occur with mobile phones after scanning QR codes like Ms. Zhang’s. On the contrary, this is just the lowest level of QR code scams and the ultimate goal of criminals. It’s always money in consumers’ pockets. And why was Mr. Zou’s payment account mysteriously stolen? How did the little QR code steal money?

QR codes hide viruses

It is understood that before the funds were stolen, most victims used Android phones to scan QR codes, or used Android phones to receive and install unknown apk files. experience. Kingsoft Internet Security experts pointed out that the theft of online banking funds is directly related to these apk files. Because victims have poor security awareness and easily install programs provided by strangers on their mobile phones, theft of funds occurs. "These apk files are all mobile phone viruses. Their function is very simple: intercept the victim's mobile phone text messages, and transmit the text message content through text message forwarding or email. The key information in the text message content is the verification code sent by online banking or third-party payment websites." Jinshan Antivirus security experts said, "The virus itself cannot independently complete the function of stealing online banking funds. The core threat is to steal verification codes. We named this type of virus the Verification Code Thief."

Kingsoft Antivirus Security Center analyzed nearly 200 verification code thieves and found that some directly intercepted all mobile phone text messages and sent them to the virus author's phone. At this time, the victim's phone will not be able to receive any text messages. Some verification code thieves screen the content of text messages and only intercept text messages containing keywords such as "bank, verification code, payment" and obtain the content of the text messages by forwarding text messages or sending them via email. This is more covert, and by the time consumers notice the anomaly, their bank card balances have been robbed.

How could the money in the bank card be lost if only the text messages were taken away? Many people have not noticed that mobile phone text messages have actually become the cornerstone of security for online banking payments and quick payments. The activation of online banking functions, the login and consumption of payment tools all use mobile phone text messages to verify identity. When your phone is installed with a Trojan that intercepts text messages, it is equivalent to your phone being in someone else's hands at the moment. And the person who takes your phone knows the victim's personal information through other channels, just like someone who knows everything about you. If a person knows everything about you and takes away your mobile phone, he can control your bank card as he pleases.

Security experts say that writing CAPTCHA robbers does not require advanced skills. In fact, some CAPTCHA robber virus authors are complete novices. The thief's mobile phone number and email account password can be easily found in the virus code. After logging into the mailboxes used to collect text messages from victims, we made even more shocking discoveries: the authors of the verification code thieves collected thousands of text messages, and there were hundreds of victims. Many payment tools, including online banking and Alipay, have fallen prey to verification code thieves. Kingsoft Antivirus Security Center has analyzed and counted the CAPTCHA thieves and stated that the activity of the CAPTCHA thieves has exceeded that of the online shopping Trojans that were rampant on computers a few years ago, and the actual losses caused by the CAPTCHA thieves to netizens have also greatly exceeded those of previous online shopping Trojans. . CAPTCHA thieves have become the number one enemy of smartphone users’ online banking security.

It is dangerous to "scan as soon as you see the code"

Although QR codes are becoming more and more common in the market, many consumers still do not really understand what a QR code is. Ms. Zhang also said later: "I didn't know what a QR code was before, and I didn't expect that the results of scanning it would be so serious." Consumers' "understanding" provides an opportunity for criminals.

Software professionals remind consumers: "A QR code is actually a string of URLs, and it is very simple to generate and publish it. The production of QR codes is also "zero threshold", as long as you download a QR code generation software , a QR code image can be generated by putting relevant links. Therefore, some people put URLs with virus programs into the QR code. If consumers accidentally scan it, they may be infected. "Experts warn. Many consumers must know the source of the QR code before scanning it. Do not scan the QR code when you see it, as it is easy to fall into the trap of criminals. Generally speaking, QR codes provided in regular newspapers, magazines, and posters in well-known shopping malls are safe, but QR codes from unknown sources posted on websites need to be vigilant.

360 security experts said that QR codes cannot be "scanned as soon as you see the code", and you must be especially wary of QR codes sent by strangers, such as QR codes with software downloads and account login webpages. Close the page now. If your mobile phone has ever scanned a suspicious QR code, you should use professional security software such as 360 Mobile Guard to check and kill it to avoid text message leakage or even property damage.

Some mobile phone players suggest that if you are a "code scanner", you should use a professional code scanning tool with monitoring functions. When a suspicious URL is scanned, there will be a security reminder. For software installed through QR codes, after installation, it is best to scan it with anti-virus software before opening it. Of course, consumers can also choose a code scanner with identification function for real-time monitoring. This type of mobile security software has added a detection function. When a suspicious URL is scanned, a security reminder will be issued.

Consumers should increase their awareness of prevention when facing QR codes. If their mobile phone is bound to a bank card, they should not store excessive amounts of funds in the bank card to avoid chain reactions and heavy losses. At the same time, do not be tempted by criminals, such as the trap of offering preferential policies by scanning the QR code. The government and relevant departments should also strengthen the management and regulation of the QR code market. Many QR codes have their own problems that make it more difficult for the government and relevant departments to manage them, such as low production thresholds and the inability to set unified restrictions. Therefore, the government should quickly conduct research with relevant departments and develop effective management plans to prevent QR code scanning fraud from happening again.