QR spoofing: A rising cyber scam around the world

A new type of cyber scam—QR code spoofing—is rapidly spreading in the United States, Singapore, and several European countries. At first glance, the scheme seems simple, even primitive, which is precisely what makes it so dangerous: victims often have no idea that scanning a QR code in a café or parking lot could lead to their entire card balance being stolen.

In Armenia, no cases have been reported yet, but cybersecurity experts warn that the scheme is too simple, inexpensive, and effective not to appear locally soon. This makes it critical to inform users before it becomes a widespread threat.

How QR Spoofing Works

The scam follows a consistent pattern, which contributes to its scale. Fraudsters print a fake QR code—typically linking to a money transfer or phishing site—and discreetly place it over the original code in cafés, parking lots, self-service offices, or vending machines. When a customer scans the code, thinking they are paying for a service or leaving a tip, the payment is instead redirected to the scammer, or the victim is taken to a fake website where they enter card details.

In Singapore, there have been cases where criminals replaced QR codes on tables in chain cafés. Customers believed they were paying through official mobile apps, but the money went to unknown recipients.

Why It’s More Dangerous Than It Seems

QR spoofing is particularly stealthy because people generally consider QR codes safe. Creating a fake code takes only about 30 seconds, and spotting it is difficult, especially when it is pasted over a code of the same size. Surveillance cameras provide little protection, as the replacement can happen in a fraction of a second.

Increasingly, scammers use dynamic QR spoofing: the code leads to a page that automatically populates the correct payment amount, purpose, and even the company logo, making the interface appear official.

The Situation in Armenia

The good news is that QR spoofing has not yet spread in Armenia, and there are virtually no official reports of such cases. The bad news is that it is likely only a matter of time before it appears. As QR payments become more common in cafés and stores across the country, scammers tend to replicate schemes that have already been “tested” elsewhere. Notably, this type of fraud requires no programming skills—just a printer—making preemptive caution essential.

How to Protect Yourself

Several simple precautions can significantly reduce the risk of falling victim to QR scams:

• Inspect the physical QR code. Avoid scanning if there are signs of a sticker, unusual paper, or uneven edges.
• If scanning opens a suspicious website domain, close it immediately.
• Never manually enter card details after scanning, as QR payments do not require them.
• Always verify the payment amount before confirming, since scammers may automatically set it higher.
• If in doubt, ask an employee to confirm that the QR code is legitimate.