Fraud Protection

Fraud is a criminal act to deceive you and take your cash – it's a transaction that you didn't know about or authorise. For example, fraudsters may use your details to open accounts under your name or your business.

A scam is where you’re tricked into making or authorising a payment to a criminal’s account. Scammers impersonate banks and official organisations using emails, phone calls and texts that look and sound genuine.

Quishing - QR code phishing

Whilst many people are aware of the risks associated with scanning QR codes in public places or that are received by email, such as being directed to a malicious website or downloading malware, most are not aware of the risks of sharing QR codes that are specific to them and are generated to confirm their identity.

Businesses may be targeted by fraudsters impersonating genuine individuals from trusted organisations asking them to share QR codes that have been generated to validate them or confirm an action. Attackers often use QR codes to bypass security systems and introduce undetectable malicious links into organisations. These can be embedded in PDF documents, attached to emails, or within emails themselves. Recipients are told to scan the QR code using a mobile device. They are then redirected to a phishing website designed to capture their login credentials.

However, attackers may also ask individuals to share QR codes that have been generated during the log in or set up process of online accounts, such as their online banking or email accounts which they can then use to impersonate the individual and compromise the security of their online accounts.

How employees can avoid falling victim to QR code fraud:

• Never scan QR codes, click on links, or open attachments in emails from unverified senders
• Personal information: never enter any personal or security information in a site accessed through an unverified QR code or email link
• Account compromise: QR code phishing can be used to gain access to genuine accounts. Never share QR codes generated by online accounts with anyone, by any communication methods, even if they claim to be from the genuine organisation and are offering help.

How organisations can protect their employees against QR code fraud this year:

• Ensure strong email security to reduce the possibility that employees receive fraudulent emails in the first place
• Ensure multi-factor authentication: even if account login details have been compromised via a QR code, dual authorisation could block fraudsters from full account access
• Employee training: make all staff aware of the risks of phishing emails and the risks of sharing QR codes via any communication methods.

Remember that Barclays will never:

• Ask you to make payments or move money to a ‘safe account’
• Call and ask you to provide or enter your PIN or use your biometric device, for any reason
• Take control of your computer or call you unexpectedly and direct you to a website.

Stop fraudsters in their tracks

Visit our phishing page to learn more about phishing, account compromise threats and how to protect your business.