A Calgary family already struggling with the high cost of living is now struggling to get their money back after falling victim to a new, online scam involving a QR code.
Amalyn Cooke recently posted a stroller for sale on Facebook Marketplace. A man responded and asked if he could put half of the asking price down to hold it. He then sent her what appeared to be an Interac e-transfer with a QR code embedded inside. He told her she had to scan the code in order to accept the money.
Cooke did, and said the code redirected her to what looked like her bank’s webpage.
“Everything the same, looked the same,” she told Global News. “You put in your bank account and your password. ”
What she didn’t know was that she wasn’t on her bank’s website. She was actually on a fraudulent website, mimicking her bank connectFirst Credit Union.
“They managed to make it look identical to a real connectFirst e-transfer,” husband Steven Cooke confirmed. “They built a website for this that mimics the bank that you use.”
The couple said they were told the e-transfer would be cancelled, but it wasn’t. They were out a total of $10,000 in mere moments.
“$8,200 was the first one,” the Cooke’s said. “And we were, ‘Oh my goodness what is this?'”
The family then placed a frantic call to the credit union but said while they were on with a representative, the fraudsters were able to withdraw another $1,800.
“We finally got a hold of someone, and we were, ‘Hey this is happening can you do something? Please lock the account — stop this from happening.'”
“I work for two jobs just to save that money,” Amalyn said. “That money not easy to make. It’s my hard work.”
“That’s where it hurts me the most,” Steven added. “She worked two jobs and sacrificed her life and some guy just took it in not even 10 minutes.”
Global News reached out connectFirst. A spokesperson said the company’s priority is making sure members feel confident in its ability to keep their hard-earned money safe. The statement added it is “truly sorry for any members who experience this type of trouble and emotional burden.”
However, officials also said there are multiple levels of safeguards built into their policies and procedures to ensure security, including two-factor authentication. Another safeguard, officials pointed out, relate to e-transfer auto deposit transactions — which come with a warning.
“We encourage all our members to be extra vigilant and exercise extreme caution to help prevent fraudulent activity from occurring.”
“Yeah, it was my fault to put my details,” Amalyn said she was told by the credit union. “My bank account number and my password — so it’s my fault.”
QR code security
Jamie Hari, director of Cybersecurity Product Management for the Canadian Internet Registration Authority (CIRA), said it’s easy to think QR codes are secure.
“Generally speaking, they’re not safe,” he told Global News.
“Folks are getting used to seeing them especially on places like parking meters and in menus in restaurants and that feels safe because you’re seeing them everywhere. The problem is that the malicious actors are really starting to take notice of them just as much as anyone else.”
“So, now they’re beginning to attack using QR codes in the wild,” he added.
Hari said like any other phishing attack, the scammers are trying to collect information from people, but he said these kinds of attacks can be much more malicious. He added they can also link directly to malware, infecting your phone, camera and iOS system on computer.
Hari said it’s unreasonable to not use these codes, but he said people should use them wisely. That, he said, includes updating your browser and apps regularly as well as personally being up to date when it comes to these scams.
CIRA also offers a free service called Canadian Shield that is downloadable as an app.
The Cookes, who just had a baby boy, Austin, 25 days ago, contacted police as well as the credit union. They said while they don’t expect they’ll get any money back, they wanted to make sure no one else was scammed.
“Between the police and the banks, they don’t care,” Steven said. “These scammers are getting away with everything and it’s going to get worse, not better, because now the technology is getting better.”