By Beatriz Marie D. Cruz, Reporter

PHILIPPINE micro, small and medium enterprises (MSMEs) should invest in payment security to stop unscrupulous groups from stealing their money through malicious QR (quick response) codes, according to industry experts.

“Usually, the big companies have the budgets and have a point of sale device that can generate a QR code,” Jocel G. De Guzman, co-founder of group Scam Watch Pilipinas, said in a video interview. “Most victims [of QR code scams] are MSMEs that print their QR codes, and this can easily be tampered with.”

About 38% of Filipinos who use mobile wallets prefer QR codes as mode of payment, according to a study by Visa. This comes as the Bangko Sentral ng Pilipinas targets a 60% to 70% share of digital payments in total retail payments by 2028.

However, their popularity has led to the rise of fake or malicious QR codes that lead users to malicious websites or phishing attempts.

QR code phishing or quishing is a form of a modern social engineering cyberattack where users are tricked to give away personal and financial information to scammers.

One of the most common forms of QR code-related attacks include tampering legitimate QR codes, which allow scammers to easily steal information, according to information technology (IT) management provider ManageEngine.

“Scammers will change the QR code physically, like put a sticker on top of the QR codes, so when it is scanned, users will be redirected to phishing websites and get their information,” Onil Jaia Leyda, technical solutions consultant at ManageEngine, said in a Feb. 21 interview.

Fake and malicious QR codes have also been more sophisticated with the rise of artificial intelligence (AI), he added.

Data from the Philippine central bank showed that 59.48% of cyberfraud losses in 2023 were driven by phishing attacks, identify theft and account takeovers.

To protect themselves from fake QR codes, MSMEs and consumers should verify if the code is legitimate. They can do so by checking for misspelled words and suspicious URLs (uniform resource locators), according to IT security company Trend Micro.

Consumers should also update their mobile devices with security features, such as in-place web filtering and multi-factor authentication, to safeguard them against fake QR codes, Mr. Leyda said.

He also cited the need for the government and private sector to increase user education and awareness against fake and malicious QR codes.