3 ms·

> Customers simply scan it with their phone camera to open a website for the online menu. Then they can input their credit card information to pay, all without

by teeray 5y ago

> Customers simply scan it with their phone camera to open a website for the online menu. Then they can input their credit card information to pay, all without touching a paper menu or interacting with a server It is only a matter of time before we end up with “digital skimming.” Spoof the site, ask for a CC number, forward the request onward. How would patrons know the QR code was not genuine?

kalleboo 5y ago
This is definitely already a thing. There were reports of that happening here in Japan when the QR code payment system PayPay took off a few years ago. People would paste their own QR code ontop of the store one
- toss1 5y ago
  Seems like an opportunistic scam, and a great way to get caught if the would-be scammers do not previously put in place a serious money trail obfuscation system. The investigator has, as the first piece of evidence, basically a direct link to the criminals' bank/ccard acct, for which the bank is legally required to have owners' ID. The casual scammers get caught, the professionals/serious gangs easily obfuscate the trail, and trust in the systems declines further.
KMnO4 5y ago
In 2011 I remember reading about “QR phishing”, where a transparency is overlaid on a QR code to completely change the data while barely modifying the representation. http://wordpress.mrreid.org/2011/08/06/hacking-qr-codes/ http://wordpress.mrreid.org/2011/08/06/hacking-qr-codes/
captainbland 5y ago
In the current state of play you might be right. I think many of the same rules apply to anti-phishing. A lot of it is about education: making sure that patrons know what a legitimate QR code domain is going to be in advance so they can check it, providing some reporting system for suspect ones (this probably just means telling a member of staff so they can scrape it off and tell the police). There are some additional advantages afforded to us in the real world like, if the need arise, they could be made hard to forge by including custom holograms, embossed patterns and the like. Although at the moment it seems not many places are taking advantage of these kinds of practices yet, probably because a high profile breach has yet to happen around it.

by teeray 5y ago

kalleboo 5y ago

This is definitely already a thing. There were reports of that happening here in Japan when the QR code payment system PayPay took off a few years ago. People would paste their own QR code ontop of the store one

toss1 5y ago
Seems like an opportunistic scam, and a great way to get caught if the would-be scammers do not previously put in place a serious money trail obfuscation system. The investigator has, as the first piece of evidence, basically a direct link to the criminals' bank/ccard acct, for which the bank is legally required to have owners' ID. The casual scammers get caught, the professionals/serious gangs easily obfuscate the trail, and trust in the systems declines further.

KMnO4 5y ago

In 2011 I remember reading about “QR phishing”, where a transparency is overlaid on a QR code to completely change the data while barely modifying the representation. http://wordpress.mrreid.org/2011/08/06/hacking-qr-codes/ http://wordpress.mrreid.org/2011/08/06/hacking-qr-codes/

captainbland 5y ago

In the current state of play you might be right. I think many of the same rules apply to anti-phishing. A lot of it is about education: making sure that patrons know what a legitimate QR code domain is going to be in advance so they can check it, providing some reporting system for suspect ones (this probably just means telling a member of staff so they can scrape it off and tell the police). There are some additional advantages afforded to us in the real world like, if the need arise, they could be made hard to forge by including custom holograms, embossed patterns and the like. Although at the moment it seems not many places are taking advantage of these kinds of practices yet, probably because a high profile breach has yet to happen around it.