QR Code Scams Surge in New Zealand: A Growing Threat to Consumers

New Zealand is experiencing a significant rise in QR code scams, with these fraudulent schemes now accounting for approximately one in ten cyber threats detected locally. Cybersecurity experts are issuing urgent warnings to the public, highlighting the evolving tactics of cybercriminals who are increasingly targeting mobile users through seemingly innocuous QR codes.

• QR code scams, also known as ‘quishing’, have more than doubled in prevalence in New Zealand since March.
• These scams are often linked to new import charges, making courier payment requests appear more legitimate.
• Attackers are employing multi-format strategies, combining emails, documents, and QR codes to bypass security measures.
• The convenience and perceived harmlessness of QR codes make them an effective tool for scammers.

Cybersecurity firm Eset has reported a dramatic increase in QR code scams across New Zealand. These attacks, often referred to as ‘quishing’, now represent a substantial portion of cyber threats, with their share more than doubling in recent months. This trend indicates a shift by attackers towards methods that exploit the widespread use of smartphones.

A contributing factor to the surge in these scams is the recent introduction of import charges on parcels valued under $1,000. This new levy, sometimes dubbed the "Temu tax," adds a small fee and has led to an increase in consumers receiving requests for courier payments upon their goods’ arrival in New Zealand. Many shoppers are unfamiliar with these post-purchase fees, making fraudulent payment requests appear plausible, especially when they mimic legitimate delivery notifications from well-known brands.

Reported instances of QR code scams in New Zealand include:

• Fake payment requests impersonating NZ Post.
• Unsolicited parcels containing QR codes designed to trick recipients.
• Fraudulent QR codes displayed on parking meters.
• Fake public Wi-Fi prompts that lead to malicious sites.

Scott Leman, New Zealand country manager for Eset at Chillisoft, noted that attackers are adept at adapting to normal consumer behaviour. "We’re now seeing a situation where people are receiving legitimate requests for courier payments they may not have expected, and that creates confusion. Attackers can leverage that uncertainty to insert fraudulent messages that look almost identical," he explained.

Cybercriminals are moving beyond single-format attacks, increasingly adopting multi-format strategies. This can involve an email containing a PDF attachment that prompts the user to scan a QR code on their mobile device, which then directs them to a fake website. This layered approach makes attacks harder to detect and bypasses traditional security filters, as the malicious destination is not visible until after the QR code is scanned.

Experts urge the public to exercise caution. Key advice includes:

• Avoid scanning QR codes from unknown or untrusted sources.
• Be wary of unexpected payment requests or delivery notifications.
• Consider using security software that can scan and block malicious links before they are opened.
• Never enter sensitive information on a website unless you are absolutely certain of its legitimacy.

While overall cyber threat detections may fluctuate, the composition of these threats is changing, with QR code scams emerging as a significant and growing concern for New Zealand consumers.

• QR code scams now one in 10 threats in New Zealand, SecurityBrief New Zealand.