Mr. Talcove said the only way Americans can protect themselves is to not scan QR codes unless they are certain a code is legit or use a second phone without sensitive information stored on it.
Once scanned, a fake QR code can intercept a restaurant meal payment or install malware that locks the phone and retrieves financial details stored on it. Before the victims can reset and wipe a device, thieves have read emails and emptied bank accounts.
“I wouldn’t scan a QR code because it’s impossible to tell good from bad and you don’t know until it’s too late,” Mr. Talcove said. “My entire life is on my phone. I’d rather lose my wallet.”
The International Association of Financial Crimes Investigators, a California-based nonprofit, calls the fake codes “quishing scams.”