The National Gendarmerie has spotted a new scam. It offers customers the opportunity to test Amazon products for payment through a fraudulent letter encouraging them to flash a QR code which in fact leads them to a fraudulent Amazon site.
You know now, when it’s free, you’re the product. In this case, the alert from the National Gendarmerie, already on the spot to warn you of quishing, also proves that when it is too good, there is a problem.
Because it is indeed a scam that our colleagues from France Info report in an article dated May 2, 2024. The principle? Attract users by offering them free tests of Amazon products, for a fee. To register, nothing could be simpler, a QR code displayed in an email to flash to be redirected to the Amazon site. But where is the wolf? It is of course hidden in the QR code, which leads the unfortunate people straight into its mouth, a fake Amazon site.
A scam which, unfortunately, has nothing unusual except the method used by hackers to lure their victims: our good old yellow and blue mailbox, that of La Poste.
Free and paid product tests, the new scam using the Amazon site
Chance sometimes does things well, because it was a member of the National Gendarmerie who almost paid the price for this new scam. In fact, he received a letter containing a tempting offer: receive Amazon products for free, and test them while being paid. To do this, nothing could be simpler: chief warrant officer Nicolas Renaud just had to flash a QR code, supposed to redirect him to Amazon and the test program. Probably because he is not a 6-week-old rabbit, and also because certain details have not escaped his nose. “ What tipped me off was the quality of the support, the printing, the closing words of the letter: “all my best wishes”, and above all an email address that did not correspond at all to Amazon », he explains to France Info.
Neither one nor two, the soldier is leading the investigation. And of course, by flashing the famous QR code which appears in this shaky mail, he lands on a site resembling that of Amazon, but which seems far too curious to him. In fact, it is a real online interrogation that he undergoes: name, first name, email address, postal address and… bank details. But this is only the first phase of the scam.
Because a few days later, the users who gave in to the temptation of profit and gave all this personal information on the fake Amazon site were called by, again, their so-called banking advisor, who just had to unfold his speech: he gives them their contact details to be credible and tells them that suspicious transactions are in progress on their account. To put an end to it, the scammer manages to make them validate these purchases and loot them.
Why the trap is set by post and how to protect yourself from quishing
A case relayed by the National Gendarmerie, which, on its X.com account (formerly Twitter), alerts its subscribers of this new scam.
If the quishing method is not new, the technique used by scammers to reach their victims is both new and as old as… The Post Office. Because it is by post that scammers send this famous letter offering to test Amazon products for free for a fee, on which appears the QR code to flash. A scam that bridges the old and new worlds of communications. And this step back is not trivial. If they had sent this letter in the form of an email, given the wacky address that appears on the paper mail, in most cases it would have gone directly into their recipients’ spam folder. To be sure to reach more victims, the postal route was therefore chosen by the scammers who then turn into hackers.
And once the QR code is flashed, victims fall into the quishing trap.
The Gendarmerie issues the usual warnings, such as not scanning these QR codes, reporting any suspicious profiles on the Pharos platform and being proactive with your loved ones. Clubic doubles down on these common sense tips by adding a few details to protect you from quishing.
For example, carefully examine the shape of the QR code. On a charging station, a sticker containing a QR code could be incorrectly stuck on top of another. Likewise, be sure to check the text and URL associated with the sticker or whatever is displayed on your phone when using the camera to scan the code.
If a QR code redirects you to an app on Google Play or the AppStore, be careful and check all the details. Likewise, be wary if the QR code leads you to download security software, or if you encounter QR codes in unusual places that might pique your curiosity.
Source : France Info
1