DoctorOz: QR Code Scams That Could Drain Your Bank Account!

I want everyone to pull out your phones. I'm gonna tell you why in a second, but it's really important. All right, get your phone out. Now, in a world where technology is constantly evolving, we're all trying to keep up with changing trends. The one group that has their finger on the pulse of the latest and greatest are the scammers, right? Now they are targeting people who use QR codes, all the ones you see in all the restaurants now, an updated version of the old-fashioned barcode. Now, here's how it works. Again, get your cameras out, right? Your phones, turn the camera on, and then I want you to look at this QR code. You see that right here on the screen? Now, hold your camera to it, and it will automatically scan that code. I'm gonna give you a second. I'm gonna leave the code up there for a minute. Go ahead and do it. Put your camera on, aim the camera at the QR code like you normally would, and you're gonna see a website come up. Where did it take you? To the website with a handsome baby picture of me saying, don't toy with me. God, that was an awkward time in my life. Anyway, it's a harmless photo, but scanning a scammer's QR code could have taken you anywhere on the internet, and crooks are using these QR codes to clean out your bank account. Security expert Bill Stanton wanted to see just how easy it is to set a QR code trap. Here's how the new QR code scam works. Bill Stanton is acting as our scammer. He goes out looking for real QR codes from good, honest businesses. Then when he finds one, he sticks his fake QR code right over the real one. So when the customers scan the fake code, they're sending their personal info right to the scammer. Scammers use this info to drain people's bank accounts and to steal their identity. We set up a social experiment to see just how easy it is to scam customers. First, we found a lovely bakery in Tuckahoe, New York. They were offering a contest for a free chocolate cream birthday pie. Just scan their QR code to enter. We rigged the bakery with cameras. Bill enters, and when no one is looking, he brazenly puts a fake QR code sticker over the bakery's QR code. Then he finds a nearby table and waits for customers. It takes only 10 minutes for his first victim to scan the QR code. This is what pops up on her phone. Time to confront her. My name is Bill Stanton, I'm with the Dr. Oz Show. Now, we just saw that you scanned that code right there. Yeah. Now, what you potentially did was give up all your information, so you had no idea that was happening, did you? No, no, and you know, you do it at restaurants now all the time, or front doors of places you go to eat, to the menu, so yeah, it's good to know, I never thought about it. Minutes later, another victim scans the QR code. You just got scammed by me being a would-be scammer. If I'm inside the establishment, right, then it would be sanctioned. That's what you would think, but I put the sticker up when they weren't looking, where people would do that, thinking that there's not a sticker on it, and potentially, I have your bank account, I have your credit card information. Off the scan? All that stuff off the scan. We couldn't resist fooling a few more customers. I am so sorry, you have been scammed. No! Yes! But don't worry, no one in our experiment was actually scammed. In fact, we sent them all home with a free chocolate cream pie. We're not taking your identity, but you get the pie. So much better than taking my identity. My goodness, that was just too easy. Security expert, Tolstantin, is joining me now, along with Maria, who stepped right into our trap. Maria, these QR codes are everywhere, and I wouldn't have been intimidated by it anyway, but your reaction spoke volumes, and you realized that actually you had been scammed. So what did you feel when Bill surprised you? I was shocked. I couldn't believe it. I had never thought about it like that. You know, you see it in restaurants and shops, and you know, you scan it, you walk away, and you don't think twice. I, you know, with COVID especially, it became the norm. So Bill, were you surprised how easy it was to trap the Marias of the world? Actually, no. You heard what she said. You know, she didn't think about it. So these scammers, think of like the coyote and the roadrunner. They're constantly trying to devise a new trap for us to walk into, and putting that on, she went in, scanned it. We live in a fast food society. She just wanted to get her coffee, crump it, and go, and she got scammed. So we set this up as a social experiment in a real life situation, but how easy is it for these scammers to cheat people out of their life savings? It's actually very easy. You know, placing them, hiding in plain sight. Once you get that information, they're able to download that, extrapolate, and then, you know, we live in this society where everything's on social media. Whatever they can't get from the download, they go on the Facebook page, Twitter, all these accounts, and we give that information away. All right, so you say QR codes, because they're there everywhere, right, all over the place. You mentioned restaurants as an example. How much personal information, Maria, would you have given up if that QR code that you clicked onto had requested it in order to buy a pie, of all things? I probably would have just given my email address and maybe my cell phone number, my name, obviously, but not more than that. Good, well, I'm proud of you for that. Is that too much? I don't give anything out. I mean, you go to buy anything, what's your phone number? I'm like, what's your phone number? I'll pay the extra 10%. All right, Maria, the next time you click onto a QR code with your phone, you're gonna think twice? Absolutely, I mean, it's definitely gonna come up again, and I'm definitely gonna think more about it, and now that it's in restaurants and stuff, it's definitely hard, because, you know, people don't wanna touch anything anymore, By clicking on the QR code's okay, giving information is where the problem is. Yeah. Was the pie good, by the way? It was delicious. Excellent. It was actually amazing. Well, you were lucky that some of these kind individuals didn't throw the pies at you. You know what, it wouldn't be the first time I had a pie in a face, so I'm good with that. Thanks both for being here. Coming up, how you're gonna avoid clicking your way to a cleaned-up bank account, and what you need to know in order to protect yourself and your money. QR codes, they're being used for everything, from border registration to restaurant management, to parking menus, and remembering where you parked your car at the airport, right? But the convenience has become a feeding frenzy for fraud. What can you do to protect yourself? Fraud investigator Christine Durst is joining me now. I love having you on the show. I love being here. These scammers are following the trends. This particular scam does not discriminate, so pay attention. Have we compromised our privacy with this need for instant gratification? It's gotta happen like that. We have. We're living in what I call an indulge-and-divulge society right now, so we are so anxious for that instant gratification that we indulge, we dive in, and oftentimes in the process of doing that, we divulge too much personal information to people we don't know, so it's a real problem. The other thing is, we have a tendency to dive in because everybody else is doing it, and if everybody else is doing it, it must be safe, right? I mean, everybody's scanning QR codes, and we've seen how well that can turn out for you, so it's a problem. We spend one or two minutes learning how to use an app, and zero minutes learning how to use it safely. That's a problem. I sometimes think it's done on purpose because you've got so many little options you can click on, and who has the time for that? I just wanna just quickly do something. Don't we all? All right, so after you scan the QR code, we're gonna walk over here, you've gotta be careful about the website you're taking to because oftentimes you have no idea what it is. How do you make sure that it's a safe website that's legitimately interested in your well-being? One of the first things that you need to do is make sure that when you go into a place, whether it's a bakery or elsewhere, and you're there physically scanning a code, do a finger check, scratch it, and see if it's a sticker. It could be a sticker that a scammer has put over a legitimate QR code. Like Bill did in that scam we did. So beware the stickers. That's the first thing, so caution first. And then verify the source. They're always going to take you to a webpage. Be really careful about what that webpage is. So for example, if it's taking you to DROZ.com, that's not the Dr. Oz show. If it's taking you to DROZ.net, it's not the Dr. Oz show, and scammers are not above trying to make a site look like the real thing. We see it again and again. Gotta read it carefully. You do, and then they also have URL shorteners or website address shorteners. So if you see a URL that's a really short link, be suspicious because oftentimes when you click on a short link, it turns into a larger link or a longer link when you get there. So when you do, if you click on a short link when you get to the final page, take a look at what that final destination URL is as well. Don't always trust what you see on the first place. You know, these QR codes are designed to be read by robots. I said that's the original purpose. How do you foolproof the process for you, for a human being, before you scan? With the naked eye, you can't. That's the bottom line. You are not a robot. And until you have like an Arnold Schwarzenegger eye built in there, you can't do it, okay? So you need to make sure that you're taking precautions with robots that will keep an eye on you, artificial intelligence. So I suggest that you download a QR code scanner that also screens. It will help you identify whether or not the page you're landing on is malicious. It will help you determine whether or not there are dangerous things embedded in it to get you. So, and they're easy to find. Just go into your Play Store, your Apple Store, whatever you have on your phone, and look for a scanner that has that screening capability. It's just an app. It is. I use one called Sophos Interceptor, and it works really well. It's actually caught a couple of bad QR codes for me. Nevertheless, we like the convenience. So what's the ultimate no-no if you are gonna use QR codes? Ultimate no-no, and this is where most people get snagged. Do not pay your bills using a QR code, whether it's at a parking garage or in a restaurant or online. If a company is savvy enough to use a QR code, they're also savvy enough to let you do bill pay online. Bypass the QR code and do the bill pay online. That way you can be sure you are at the destination you want to be at. All right, you got three steps to help us. If we made a mistake, we've been scanned with a fake QR code, as soon as you figure it out, what do you do? First thing you wanna do is notify the proper people, and those are the folks who are going to help to protect you. So if you have given out any information that might compromise your bank account or your credit card information, get in touch with your bank and your credit card issuers and let them know that you may have compromised that information. Second, contact. Secondly, you're gonna want to get in touch with one of the three major credit bureaus. So TransUnion, Experian, Equifax. They have to communicate with each other and let them know if your social security number has been compromised, or if you think it has been compromised. They'll flag your account for six months and make sure nobody is opening new accounts using your social security number and information. And finally, you gotta report. Right, finally report, and try to resist the urge to go to the local police department. They're not equipped to handle this type of thing, and they get bombarded with these, and they feel badly because they want to help, but they're not equipped to do it. What I suggest you do is get in touch with the Internet Crime Complaint Center at ic3.gov. It's letters and a number, ic3.gov. It's the Internet Crime Complaint Center. It is run by the FBI, and they're fabulous at tracking these things down. Whether you're tech savvy or not, stick with the golden rule. If a site is asking for your personal information, do not provide it. You're all now armed with information on how to protect yourselves and power. It's in your hands. Christine Durst, appreciate you being here.