Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Organised gangs behind rise in QR 'quishing' scams

bbc.com

Post reply on HN
Print view View original

41–49 of 49 posts

Re: Organised gangs behind rise in QR 'quishing' scams

#41

Post by mytailorisrich »

saaaaaam wrote: post #38
mytailorisrich wrote: post #31

Earlier quoted context omitted.

Why do we need an app to pay for parking? I think that's the real question.

I far prefer using an app for parking - despite the frustration of having to have five or six different apps for this in my phone. I, like a lot of people don't carry small change (or even cash) and the apps offer considerable utility beyond simply paying for the parking - being able to extend your parking slot remotely, for example. It also means that you don't have to hunt around for the parking meter for a particu…

Pay machines that only accept cash are long gone. In fact pay machines that accept cash at all are on the way out as it is getting card/contactless only. Monitoring is already done by ANPR and so pay machines do require entering car registration numbers (which can also be printed on ticket for visual checks).

I think contactless is as easy and convenient as it gets. Enter registration number, tap, done.

If the government wanted to madate something useful for consumers it should mandate pay machines instead of app/phone only as some car parks now are.

The only reason these apps are becoming ubiquitous is that they are cheaper for the operators than installing and maintaining pay machines. That is it.

Re: Organised gangs behind rise in QR 'quishing' scams

#42

Post by beeflet »

tokioyoyo wrote: post #26
beeflet wrote: post #22

Earlier quoted context omitted.

they could just put a QR code of a different wechat account

Since it's all tied to real IDs, wouldn't that involve heavy risks from the scammer's side? I know it's possible, but still a bit less risk if your Scam HQ operates overseas.

I suppose, but you could say the same about bank transfers in the west

Re: Organised gangs behind rise in QR 'quishing' scams

#43

Post by echoangle »

mytailorisrich wrote: post #36
echoangle wrote: post #32

Earlier quoted context omitted.

What’s the alternative? Machines to pay are much more expensive than a sign with a QR code.

You don't need an app to accept online payments. There are indeed pay machines, and removing them is only a profit-squeezing play by the operators. You also never need the QR code. It's only provided as a "convenience". And in fact they usually also provide a way to pay by phone (see illustrative picture in article). So these are all issues created by bad engineering and operators trying to squeeze as much as they ca…

> You don't need an app to accept online payments.

Right, but does it matter if it’s an app or a website?

> There are indeed pay machines, and removing them is only a profit-squeezing play by the operators.

Yes, and?

> You also never need the QR code. It's only provided as a "convenience". And in fact they usually also provide a way to pay by phone (see illustrative picture in article).

Of course you don’t need a QR code specifically, but you probably need some kind of URL (which can then be imitated by the scammer) so everyone can pay.

> So these are all issues created by bad engineering and operators trying to squeeze as much as they can without consideration for the users.

I wouldn’t call it bad engineering, it’s a tradeoff. Either expensive machines for every parking space or a simple sign with a QR code.

Re: Organised gangs behind rise in QR 'quishing' scams

#44

Post by nojs »

VMG wrote: post #34
mytailorisrich wrote: post #31

Earlier quoted context omitted.

Why do we need an app to pay for parking? I think that's the real question.

SOMEBODY needs to create a canonical app, because otherwise that hole will be filled by organized gangs

https://xkcd.com/927/

Re: Organised gangs behind rise in QR 'quishing' scams

#45

Post by 0xEF »

hackable_sand wrote: post #28
0xEF wrote: post #21

Can we stop making new -ishing words for scams? This weird lingo is part of what turns the less savvy users off from paying much attention to their personal security. Just say a [type of] scam such as "a QR code scam" or "text message scams," etc. We do not need to coin a new term for each one of these things and nobody is winning any prizes for adding more layers of abstraction to fight through when trying to commun…

The delineation is useful for broad audiences.

As someone who regularly has to digest relevant security information and deliver it to teams that generally do not know a lot about or do not enjoy using computers, I can tell you that no, it is not useful.

Re: Organised gangs behind rise in QR 'quishing' scams

#46

Post by trilbyglens »

Arch-TK wrote: post #9
somerandomqaguy wrote: post #7

The parking garage one can be really insidious. The parking apps where I live in Canada have a terrible design; you absolute cannot start parking session without an account that requires you to input name, address, phone number, and then the app itself has other technical glitches that genuinely made me wonder if I had been scammed. What makes it doubly so is that the parking companies have been removing the parking…

That's just all parking apps in my experience. The websites (if they exist) are usually about as bad. Car parks make more money if they can fine you, so there's no incentive to make payment easy or make it work reliably.

Citymove in Prague works really well and has great design ;)

Re: Organised gangs behind rise in QR 'quishing' scams

#47

Post by flowerthoughts »

shaunkoh wrote: post #3

How do you protect yourself from this? Treat public QR codes like "free" USB drives – don't use them?

Yeah, we need authenticated QR codes and web of trust (only half-joking.)

My experience is that Easypark works in most of Europe and is great because of that. I trust them, and that's all I need. I really avoid QR codes, and I don't want to install your little local app.

Another commenter in this thread says parking works well in China, because WeChat is the trusted middle man.

Sadly, as always, winner takes it all has its benefits in terms of ease of knowing what to trust.

Re: Organised gangs behind rise in QR 'quishing' scams

#48

Post by varenc »

Arch-TK wrote: post #39
varenc wrote: post #14

Earlier quoted context omitted.

and how do you know the real parking company's URL is 'city-secure-parking.com' and not 'express-city-parking.com'?

I mean in this case I would recommend using a search engine to cross-reference, and any other phishing countermeasures you might normally use. I think the situation is dire when it comes to non-technical users, but I don't think QR codes are the problems here, someone could equally well paste a sticker over the entire board with all the URLs replaced or with details of a completely different (fake) parking company (b…

My actual IRL solution would be to look up the parking company and their domain based on the lot's Google/other map data. It might also be fake but that seems less likely.

If there's no machine to pay directly, no attendant, not a city owned lot, and no verifiable payment site online... I'd be inclined to do what someone else suggested and just not pay and see what happens.

The real solution seems like it should be a physical payment machine that accepts credit cards/cash. Those could also be fake, but much much harder to pull off successfully. (easier to track fraudulent credit cards processors, and no chance of leaking CC credentials with EMV contactless)

Re: Organised gangs behind rise in QR 'quishing' scams

#49

Post by saaaaaam »

mytailorisrich wrote: post #41
saaaaaam wrote: post #38

Earlier quoted context omitted.

I far prefer using an app for parking - despite the frustration of having to have five or six different apps for this in my phone. I, like a lot of people don't carry small change (or even cash) and the apps offer considerable utility beyond simply paying for the parking - being able to extend your parking slot remotely, for example. It also means that you don't have to hunt around for the parking meter for a particu…

Pay machines that only accept cash are long gone. In fact pay machines that accept cash at all are on the way out as it is getting card/contactless only. Monitoring is already done by ANPR and so pay machines do require entering car registration numbers (which can also be printed on ticket for visual checks). I think contactless is as easy and convenient as it gets. Enter registration number, tap, done. If the govern…

I've encountered pay machines that only accept cash twice in the past couple of years in rural areas and was surprised. Like you, I thought they were long gone, but I guess there are still some out there. Those ones did have stickers on them (fortunately!) directing me to one of the fleet of pay for parking apps out there, which I used. Not being familiar with the area though, I had no idea if the app I was being sent to was legit. I didn't even think about it, I just thought "oh, yet another parking app I need to download" and went ahead.

Contactless is easy - but there's a far higher cost (each machine needs to have connectivity etc). Plus it doesn't let you extend remotely, which is something I use very regularly. I guess from a user perspective that's a benefit, but from an operator perspective it's a potential downside - would I pre-pay for more parking if I couldn't extend? Probably. But would I potentially park elsewhere, for a car park where you pay on exit, thus removing that revenue from them entirely? Possibly. I guess it would depend on lots of factors, and my one-person study is perhaps not the most reliable data!

I agree that they are becoming ubiquitous because they are cheaper for operators, but I don't think that this is the only reason: I do think that they genuinely offer greater utility than a pay at machine with contactless option.

Interested to know what you mean "monitoring is already done by ANPR" because this is not my experience where I am based. Do you mean street based parking, or in car parks?

For the street based parking where I am the traffic wardens have a tablet that shows them the make, model, registration number of the vehicles parked in a particular area, and generally make their patrols on foot, so I'm not sure there's any ANPR being used. I guess there could be CCTV cameras cover exit and entry points to particular locations, but in European countries and the UK I'm pretty sure that there need to be notification signs that your registration plate is being captured in that situation.

Post reply on HN