QR Code Spoofing and Related Security Issues

For years and years, my internet provider colleagues and I have preached about phishing and other ways that unwitting email and web users click on links that are not what they purport to be or are otherwise harmful.  And, ever since they came into existence quite a few years ago, I have advised web clients to place QR codes into their printed material, like newspaper ads and business cards, so that QR reader software — typically built into or easily installed into devices like smartphones — can be used to scan and automatically jump to web addresses encoded and embedded in the QR codes.  Turns out that QR codes, affixed to physical objects that their creators cannot easily control, can be replaced by fake QR codes that mis-direct users, such as codes attached to rental bicycles, or route payments made by smartphone, as described in this article about such security issues in China.

SIDEBAR:  What is a QR code?  QR stands for “Quick Response”, to begin with.  It is a matrix of black dots on a white square background, and is commonly seen in magazine and newspapers ads to encapsulate a web or email address that is activated when scanned by software such as an app on your smartphone.  Here is a (safe) example that would jump you to a Wikipedia page upon scanning:

QR_code_for_mobile_English_Wikipedia.svg