Quishing in Brazil: Fraudsters Swap Payment QR Codes on Websites, Stickers and Printed Boletos to Divert Funds
Brazilian outlet Olhar Digital describes a quishing fraud pattern in which criminals create or tamper with payment QR Codes so that victims' money goes to accounts the fraudsters control. The scheme appears in online shopping, in physical venues such as bars, restaurants, street markets and car parks, and in printed boletos. The Federação Brasileira de Bancos (Febraban) advises buying only from official sites, checking the URL and not starting purchases from links received in messages, emails or social media. Febraban's Raphael Mielle (via g1) stresses verifying the recipient name and amount in the banking app before confirming payment. The article is consumer-awareness guidance and cites no specific campaign, actor, victim count or IOC.
Detalhes técnicos
- E-commerce: attackers can replace the payment QR Code without visibly changing the page or purchase data, or build fake pages imitating known stores.
- Physical venues: fake QR Code stickers are placed over legitimate merchant codes.
- Boletos: printed documents are altered and the original QR Code is replaced by one that points to a different recipient account.
Remediação
- Check the recipient name and amount in the bank app before confirming the payment, and stop if they do not match the purchase or merchant.
- Buy from official sites, check the URL and avoid starting purchases from links in messages, emails or social media.
- Inspect physical QR Codes for overlaid stickers or signs of tampering.
- Verify the recipient shown in the banking app even when a printed boleto looks legitimate.
- Be wary of very attractive offers and of pressure to pay immediately.
Linha do tempo
-
Quishing in Brazil: Fraudsters Swap Payment QR Codes on Websites, Stickers and Printed Boletos to Divert Funds
ler a análise desta fonte ocultar
Brazilian outlet Olhar Digital describes a quishing fraud pattern in which criminals create or tamper with payment QR Codes so that victims' money goes to accounts the fraudsters control. The scheme appears in online shopping, in physical venues such as bars, restaurants, street markets and car parks, and in printed boletos. The Federação Brasileira de Bancos (Febraban) advises buying only from official sites, checking the URL and not starting purchases from links received in messages, emails or social media. Febraban's Raphael Mielle (via g1) stresses verifying the recipient name and amount in the banking app before confirming payment. The article is consumer-awareness guidance and cites no specific campaign, actor, victim count or IOC.
Technical Details
- E-commerce: attackers can replace the payment QR Code without visibly changing the page or purchase data, or build fake pages imitating known stores.
- Physical venues: fake QR Code stickers are placed over legitimate merchant codes.
- Boletos: printed documents are altered and the original QR Code is replaced by one that points to a different recipient account.
Remediation
- Check the recipient name and amount in the bank app before confirming the payment, and stop if they do not match the purchase or merchant.
- Buy from official sites, check the URL and avoid starting purchases from links in messages, emails or social media.
- Inspect physical QR Codes for overlaid stickers or signs of tampering.
- Verify the recipient shown in the banking app even when a printed boleto looks legitimate.
- Be wary of very attractive offers and of pressure to pay immediately.