The rise of QR code menus as an alternative to traditional menus in restaurants during the COVID-19 pandemic is a trend that is here to stay. However, cybersecurity experts warn that scanning these codes can pose privacy concerns. QR codes may inadvertently lead consumers to unknowingly provide personal information.
QR scams are on the rise, and the majority of QR code fraud occurs at restaurants and other retail and shopping outlets. A recent QR code study by ExpressVPN found more than half of the restaurants in the U.S. have already switched to QR code menus, and many are unaware of the dangers of scanning QR codes.
On a daily basis, every medical appointment requiring a questionnaire can breed a theft of valuable documentation. Summertime is the peak season for QR theft with a boarding pass at the airport for that long-awaited summer vacation or when you are confirming a reservation at a theme park for the family.
This data can provide valuable insights into customers’ buying habits and locations, enabling targeted marketing of additional products and services in the future. Scammers can—and often will—take advantage of this by using QR codes to gather details about victims’ location, browser information, and internet history. They do this by manipulating QR codes found on menus and ordering platforms, replacing them with fraudulent codes.
When these codes are scanned, unsuspecting customers are redirected to fake websites. The faux sites closely resemble legitimate ones and are specifically designed to collect and steal personal data or reroute payments to unauthorized accounts. Disturbingly, this includes personal data such as full names, addresses, and banking information, which can fetch substantial prices when sold on the dark web.
In the search to build and protect QR codes on the nation’s restaurant menus, TFS wanted to better understand the technology. So, what exactly are QR codes anyway, and how are they used in the restaurant industry? “They are essentially a barcode that contains all of its information in a scannable square,” explained David Choffnes, executive director of the Cybersecurity and Privacy Institute at Northeastern University. Your phone can easily read a QR code and translate it into a website, URL, or app.
This has proved useful for the restaurant industry, as it allows owners to offer menus without having to worry about constantly updating physical copies or keeping them clean, something seen as a hassle during the COVID-19 pandemic. However, with the rising issue of QR code fraud, this could soon become a problem for restaurants as consumers become more reluctant to use them.
QR codes are so concerning because they look harmless and have mostly gained the trust of the average consumer despite the fact that there is very little transparency with them. Choffnes added, “It’s not like you have the 20 pages of privacy policy or anything like that next to the QR code, so there’s no transparency. That’s always a major concern. They’re designed in a way to get you to just scan and move on. They’re designed to protect companies as opposed to protecting individuals. What we’re missing here is exactly what the QR code is doing and what happens once you activate that code, so it’s definitely a blind spot.”
This lack of transparency allows third-party companies to get away with tracking user’s data without them suspecting anything due to the restaurant industry’s widespread use of QR codes. “With the QR barcode, once they open up a link on your phone, they can gather any information about your phone that’s exposed to your web browser, or if it opens up an app, then it can collect your geolocation or whatever else the app has permission to access,” the Boston, MA educator continued.
With that understanding, the next step is to understand how restaurants can work to protect their customers from these scams and protect their QR code data. Ideally, managers would make it a regular practice to inspect any promotional materials that contain QR codes in their dining rooms. These QR codes can be found on various items like table stickers, printed materials on tabletops, menus, or even posted on walls.
Regularly checking the exterior of the building for any unauthorized QR codes that might be falsely offering delivery services or similar promotions is also important. Monitoring the internet for fake websites that misuse the restaurant’s logo, brand name, or other marketing assets can help address the issue at its source and ensure that all staff members are well-informed about possible impersonation scams.
All of this can help to prevent QR code fraud, but there is no guarantee that it will be put to a complete stop. That’s why, in the digital age, it is best for restaurateurs to be very careful with QR codes and to always try to be one step ahead of scammers in order to protect their customers.
