A new form of financial fraud aims to divert electronic payments from customers to the detriment of vendors. According to IT risk professionals, cases of fraud via QR code substitution have been reported in Côte d'Ivoire.
The alert is particularly timely as an explanatory video, likely of Asian origin, showing the modus operandi of the offenders is circulating on social media. To preserve the security of daily transactions and raise awareness among economic actors, Sika Finance has examined this threat.
A simple scam, dubbed 'quishing'. 'We are talking about quishing, a contraction of QR and phishing.
In this specific case, it involves a QR code pasted over the genuine one. We also refer to QR code swapping, QR code overlay, or, in French, fraud by QR code substitution,' explains an IT risk professional.
Technically, the modus operandi remains elementary. The criminals print adhesive labels that they affix to legitimate payment materials.
They then visit small street shops and discreetly stick, or replace, these fake QR codes over those of the merchants, often taking advantage of a moment of inattention or by distracting the shopkeeper, for example during a phone call. When customers scan the QR code displayed to pay for their purchases, the money is transferred directly to the scammers' account, instead of being credited to the merchant.
This type of manipulation, which consists of covering an authentic code with a fraudulent label, is documented as one of the main forms of fraud related to QR code payments. An IT risk manager confirms the reality of the phenomenon on the ground: 'several people have been victims in Abidjan and in the interior of the country.'
A flaw that is primarily physical. For specialists, the vulnerability does not lie primarily in the payment technology, but in the management of the point of sale and the monitoring of displayed materials.
Static codes printed and left unchecked can be replaced, which creates an opportunity for fraudsters. 'This falls more under physical security, in the same way as the access control required for our premises and server rooms.
Unsupervised exposure of the labels creates the opportunity. It is very simple: do not display your QR code in an area outside our control.
Adding a layer of security to QR code payment would lengthen the process, whereas it is this ease and simplicity that have fostered the success of QR code payment,' analyzes an IT security professional. Immediate losses for victims.
The consequences are direct: the customer pays, but the merchant receives nothing. The funds are transferred to the scammer's account, while the buyer loses their money without their actual bill being honored.
The risk is all the higher because, once the transaction is validated, it is generally difficult to recover the funds. International recommendations thus insist on the need to verify the identity of the beneficiary before payment and to confirm the actual receipt of funds before handing over the goods or service.
Locking transactions. To prevent these risks, protection mechanisms must be adapted to the level of payment integration in the merchant's business.
For non-integrated cases, a specialist recommends having a merchant account, an ordinary account, and a terminal entrusted to the cashier. The latter instantly reports payments to the merchant account: the transaction is only validated when the cashier receives confirmation.
For structures with more elaborate systems, control must be automated. When the payment system is interconnected with the merchant's, a validation mechanism (transaction token or unique identifier) must authenticate each operation before it is processed by the cashier.
Without these measures, warns the specialist, the risk of fraud and quishing remains high. Furthermore, these measures align with best practices recommended to merchants: regular inspection of QR codes, confirmation of payments via a merchant dashboard or an official notification, and delivery of goods only after receipt of a payment confirmation.
Scan, verify, and pay. Simple preventive actions can also reduce exposure to risk.
A data protection expert recommends regular physical inspection of the displayed QR code, while another specialist proposes the installation of a protective grid preventing the affixing of another code without hindering its reading. Daily inspection of materials, the use of tamper-evident protections, and staff training.