Bob:
I was selling a synthesizer on a popular classifieds site. I received a message in the chat that my product was bought with delivery. And then a QR code - like you need to follow the link and enter the details of the card for which I want to receive payment.
I scanned the code with my phone from the computer screen, a page opened with a description of my synthesizer, the price and right there - a form for filling in the card details.
I have already begun to enter, but then I look: you need to write not only the number, but also the expiration date, and three digits from the back. I looked more closely at the page and then only noticed that it was a fake: there were errors in the website address, the design was a bunch of blunders. It's good that I noticed it in time.
Financial Culture Expert:
The scammers hoped that Bob would enter the card details on a fake website and thereby give them access to an account from which they could steal all the money.
The criminals encrypted the phishing link into a picture with a QR code to bypass the ad site's security mechanisms. Usually, the security service of an online site blocks dubious links, but does not prohibit the publication of images. After all, users need to exchange product photos.
Often, scammers offer to transfer the discussion of transaction details to a third-party messenger - and there they can send a link or QR code to go to a fake page.
A phishing site can try to steal both the buyer, who must enter his card details for payment, and the seller, who must receive the money on the card.
To ensure that the sale or purchase of goods on the classifieds site does not result in losses for you, follow the cybersecurity rules:
I was selling a synthesizer on a popular classifieds site. I received a message in the chat that my product was bought with delivery. And then a QR code - like you need to follow the link and enter the details of the card for which I want to receive payment.
I scanned the code with my phone from the computer screen, a page opened with a description of my synthesizer, the price and right there - a form for filling in the card details.
I have already begun to enter, but then I look: you need to write not only the number, but also the expiration date, and three digits from the back. I looked more closely at the page and then only noticed that it was a fake: there were errors in the website address, the design was a bunch of blunders. It's good that I noticed it in time.
Financial Culture Expert:
The scammers hoped that Bob would enter the card details on a fake website and thereby give them access to an account from which they could steal all the money.
The criminals encrypted the phishing link into a picture with a QR code to bypass the ad site's security mechanisms. Usually, the security service of an online site blocks dubious links, but does not prohibit the publication of images. After all, users need to exchange product photos.
Often, scammers offer to transfer the discussion of transaction details to a third-party messenger - and there they can send a link or QR code to go to a fake page.
A phishing site can try to steal both the buyer, who must enter his card details for payment, and the seller, who must receive the money on the card.
To ensure that the sale or purchase of goods on the classifieds site does not result in losses for you, follow the cybersecurity rules:
- Only communicate with buyers and sellers in the ad site's internal chat, where phishing links are blocked. And it is better to pay through the "safe deal" service, which is offered by large online platforms.
- Be wary if you are offered to go to a third-party messenger or to any external page “to fill out a transfer form”, including by using a QR code.
- Always check the site before entering any data on it. Make sure it's not a phishing page disguised as an ad portal, online store, or delivery service.
- By phone or in private messages, do not tell anyone the full details of your bank card, including the expiration date and three digits on the back, as well as passwords and codes from notifications from the bank. For a transfer from one person to another, only the card number is enough.
- Get a separate card for online purchases and do not store large amounts on it. Then, even if scammers gain access to your account, they will not be able to deprive you of all your savings.
