Peter Leventis, in a rush to grab a Bike Share bike, encountered trouble scanning the QR code to unlock it. After attempting multiple bikes, he realized that he was scanning a fake QR sticker resembling the genuine QR code on the rental bikes, but with slight variations. Curiosity led him to follow the code, which directed him to a dubious website named “Direct To App Now” prompting for personal details for parking payment, contrasting the standard Bike Share payment method.
Investigation revealed that the site was registered in early April, raising suspicions. Leventis discovered and removed five fake QR stickers from bike docks in Toronto’s east end, reported the incident to Bike Share, and disposed of the stickers. This incident marks the first occurrence of this scam affecting Bike Share Toronto.
The fraudulent QR stickers, akin to phishing tactics but utilizing fake QR codes, have previously targeted parking lots in Ottawa and Montreal. However, Bike Share Toronto had not encountered this scam before. The QR codes typically redirected users to a Spotify playlist in previous instances.
Following a report by a CBC reporter who identified a fake QR code on a bike in Toronto, Bike Share promptly issued a safety notice on social media cautioning riders about the fake QR codes and recommending using the in-app scanner exclusively.
Similar fake QR stickers leading to the same suspicious parking payment site were observed on city parking machines in Mississauga, with over 80 stickers found downtown. Mississauga authorities alerted Peel Regional Police and issued a public warning about the fraudulent stickers. The Toronto Parking Authority acknowledged the presence of fake QR stickers at its Green P lots but did not disclose the extent of the issue.
Toronto police received reports of fake QR codes on parking machines in North York, although it remains unclear if these are connected to the incidents in Mississauga. The link associated with the QR code has varied, initially redirecting to PayByPhone, a legitimate parking payment platform.
Despite the evolving nature of the scam, PayByPhone disassociated itself from the QR codes, labeling them as fraudulent. Carmen Donnell, managing director of PayByPhone North America, advised users to avoid scanning QR codes and opt for alternative payment methods.
As of the latest update, the QR code no longer directs to PayByPhone but leads to another suspicious parking site, registered only on Wednesday. Experts like Kami Vaniea from the University of Waterloo emphasize caution when dealing with QR codes, recommending users to verify links before scanning and highlighting the difficulty in distinguishing between genuine and fake QR codes.
