Imagine you’re in a rush, desperate for a quick bike ride to get somewhere important. You spot a Bike Share bike, pull out your phone, and enthusiastically scan the QR code to unlock it. But nothing happens. Frustrated, you try another bike, then another. That’s precisely what happened to Peter Leventis. As he stared at the third unresponsive QR code, a chilling realization dawned on him: “It didn’t make sense for three or four minutes and then, it all clicked.” The QR code looked… different. A tiny speech bubble, “Scan and Pay,” was nestled on the sticker, a subtle alteration that screamed alarm bells. This wasn’t just a glitch; this was something far more sinister.
Curiosity piqued, Peter decided to follow the rabbit hole. Though the code wouldn’t work with the official Bike Share app, he scanned it anyway with his phone’s camera. The link led him to a dodgy website, “Direct To App Now,” masquerading as “ParkPay.” It immediately demanded personal details like his license plate and credit card – information completely irrelevant to Bike Share. A quick online search confirmed his suspicions: the site was brand new, registered only at the start of April. This wasn’t just a minor inconvenience; it was a well-orchestrated scam. Peter, a conscientious citizen, didn’t stop there. He found five of these deceptive stickers at two different bike docks near Coxwell and Danforth avenues in Toronto’s east end. He tore them off, reported the incident to Bike Share, and then, with a sense of civic duty, discarded the fraudulent codes. Peter’s experience highlights the growing sophistication of “quishing,” a new breed of phishing that uses fake QR codes instead of traditional emails or texts, and the critical role ordinary citizens can play in combating such scams.
This “quishing” scam, though new to Bike Share Toronto, isn’t an entirely new phenomenon. It has already plagued parking lots in Ottawa and Montreal, leaving a trail of frustration and potential financial loss. Mathew Varsava, Bike Share’s director, noted that previous instances of stickers on bikes were usually harmless, leading to things like Spotify playlists. But this time, the intent was clearly malicious. The urgency of the situation was compounded when a CBC reporter, Haydn Watters, encountered a similar fake QR code on a bike near Church and Carlton. The reporter’s immediate alert prompted Bike Share to issue a “safety notice” on social media, warning riders and advising them to “only scan QR codes using the in-app scanner, not your phone camera.” This incident served as a stark reminder that even everyday public services could become targets for cybercriminals.
The problem, however, wasn’t confined to Toronto’s Bike Share program. Last week, the same exact faux QR stickers, directing to the identical suspicious parking payment site, started appearing on city parking machines in Mississauga. Colin Patterson, Mississauga’s director of traffic management and municipal parking, reported finding over 80 of these deceptive stickers downtown. “It’s the first time that this sort of behaviour has been noted in Mississauga,” he stated, expressing hope that they had caught the scam before anyone fell victim. Toronto Police have also received at least three reports of fake QR codes on parking machines in North York, though it’s unclear if these are linked to the Mississauga and Bike Share incidents. The sheer scale and rapid spread of these fake QR codes suggest a coordinated effort, aiming to cast a wide net and ensnare unsuspecting individuals across different municipal services.
Adding another layer of complexity, the fraudulent QR code link wasn’t static. It evolved, chameleon-like, to evade detection. Initially, after the first sightings, the QR codes briefly linked to PayByPhone, a legitimate parking payment service used by many municipalities, including those in the GTA. Carmen Donnell, managing director of PayByPhone North America, wasted no time in issuing a strong disclaimer: “We have nothing to do with these QR codes,” she declared, unequivocally labeling them a “scam.” Her recommendation was clear: users should bypass any QR codes and pay through established, trusted methods. By Thursday evening of that week, the charade of linking to PayByPhone was abandoned, and the fake QR codes were once again redirecting to another suspicious parking site, with a URL eerily similar to the one Peter Leventis first encountered, and registered only days prior. This dynamic nature of the scam underscores the cunning and adaptability of the perpetrators, making it even harder for the public and authorities to track and mitigate.
Kami Vaniea, an associate professor at the University of Waterloo specializing in scams and cybersecurity, shared her expert perspective, confirming that this type of scam is unfortunately common. She envisioned a scenario where “someone just giving someone a huge stack of these [QR codes] and saying ‘just put them everywhere,'” highlighting the low-tech, high-impact nature of the operation. Her core advice is simple: if a QR code looks suspicious, don’t use it. She also strongly recommended against automatically opening QR code links; instead, always check the destination URL first. Vaniea underscored the profound challenge faced by the average person in distinguishing between a genuine and a fraudulent QR code. “My only official opinion that I always push … is just how hard it is for the general public to tell the difference between a real QR code and a fake one,” she lamented. “It is impressively hard to do.” This insight serves as a powerful reminder of the responsibility technology providers, service operators, and individual users all share in staying vigilant and educated against these increasingly clever digital deceptions.