QRaware

Lessons From Incidents

Real incidents reveal how altered codes, fake payment pages and malicious downloads can expose personal data—and how simple checks prevent harm.

A person uses a smartphone to scan a QR code displayed on a large screen mounted on a wall. The screen shows various social media posts and images, including photos of people and text content. The hands of the person holding the phone are visible, and the setting appears to be indoors with a subtle stone wall design on the right.

Parking Payment Trap

A black and white urban scene featuring a public space covered with various stickers and graffiti. The stickers include QR codes, warning labels, and artistic designs, layered over a backdrop of chaotic spray paint and marker scribblings.

The Menu Sticker

A tampered parking QR code redirected drivers to a convincing payment page, harvesting card details and vehicle registration information.

A cozy corner of a café with retro-style tables and chairs. The seating is made of wicker and metal frames, set against a textured wall with subtle lighting fixtures near the ceiling. Decorative plants add a touch of greenery, and a QR code stand is placed on the table. Light streams in softly from a nearby window, illuminating a terrazzo floor.

QR Phishing Emails

Scammers placed a fake QR sticker over a restaurant menu, sending customers to a lookalike site that requested unnecessary personal data.

A person is holding a smartphone displaying a QR code towards a tablet mounted on a stand. The tablet screen shows a scan of the QR code. In the background, there is a blurred figure seated at a desk working on a laptop.

Donation Redirection

A phishing email used a QR code to bypass cautious link checking, leading employees to a counterfeit Microsoft 365 sign-in page.

A hand holding a smartphone displaying a QR code. The screen has a blue interface with text indicating it is for a payment application. The background is filled with blurred green foliage.

QR Phishing Emails

A charity event poster carried an altered donation QR code, quietly directing contributions to an unauthorised account.