QR code scam alarming New Zealand

With the convenience of online purchases, fraudsters are now experimenting with new methods to ensnare their victims. According to Eset, a European cybersecurity software company, QR code scams, also known as "quishing," have rapidly become a widespread cybercrime across New Zealand.

This situation has grown significantly over the past six months, and currently, one in ten locally reported cyberattacks are identified as these QR code scams.

Over 165,000 cyber threats targeting Eset users in New Zealand were reported in the year ending April, which is roughly equivalent to one attack every three minutes. According to Scott Leman, Eset's New Zealand Manager at Chillisoft, these QR code scams are much harder to identify than typical 'phishing' emails, which usually come with spelling errors or suspicious addresses. Demonstrating the growth of this situation, QR code scams, which accounted for 4% of all cyber threats in March, more than doubled to 9.3% by April.

The new NZ$2.21 tax recently introduced by New Zealand for parcels valued under NZ$1000 has provided criminals with an opportunity to carry out these scams more successfully. The inconsistency in the method of collecting this fee, often referred to as the "Temu tax," has caused significant confusion among consumers. Some merchants add this tax to the total price of the item, while others charge it separately. This has made it very difficult for consumers to distinguish between a legitimate payment request and a scam.

Taking advantage of this confusion, fraudsters send fake emails and text messages to the public, purporting to be official communications from well-known courier services like New Zealand Post or DHL. These messages ask the customer to scan a QR code to make the necessary payment, claiming their parcel has arrived in New Zealand. Experts point out that since no such additional fees were previously charged when ordering goods from marketplaces like Temu or AliExpress, these sudden, unexpected NZ$2.21 payment requests create a high risk of consumers easily falling for fraudsters' fake links.