Scanned and Scammed: Insecurity by ObsQRity? Measuring User Susceptibility and Awareness of QR Code-Based Attacks

QR codes offer a seamless user experience and have become universal – from accessing websites over handling payments to using electric vehicles. However, their nature of displaying embedded data in a non human-readable format raises concerns about their misuse. While traditional phishing and scams are well-studied, how QR codes might increase users' exposure to such threats remains under-explored. Our research explores users' susceptibility to QR code-based scams and phishing and examines their perception of, experiences with, and (mis)understandings about QR codes. Across three experiments with 1,876 participants, we simulated everyday tasks like online payments and shopping, comparing user reactions to traditional and QR code-mediated attacks. While several participants detected traditional phishing, almost no one identified QR-based attacks. Similarly, only 13 % recognized fraudulent QR payment requests, compared to 46 % with manually entered payment details. These findings highlight the need for security measures, as users tend to be unaware of QR codes' characteristics and potential for misuse.