Widespread Text Message Scam Warning

Miop

Today I went to Morrisons and scanned a QR code to sign up for a Morrison's card. WIthin minutes I had text messages from a service called Alerts4u saying I would receive text alerts (??) at a cost of £1.50 each.

To cancel, I would have to text STOP to a number, which would also cost me £1.50. In the text message there was a link to a contract which I was now party to without my knowledge.

This company is so cheeky it has a website and is registered at Companies House. When I had a look on Trustpilot, there are  so many messages from people who were signed up by scanning QR codes for ITVX, a car park, a council app, Tesco, Lidl, Asda, Iceland.....I don't know out how they have done it....it seems to be done when you scan the QR code to download an app, but it sends you these messages instead.  So many people have been caught and some have lost hundreds because they didn't realise they had been signed up to it. Some people were paying £10 per text sent to them.

The company has been reported to Action Fraud (the police) many times but the website is still up and the scam still in operation. Remember, this is not a matter of being silly, or being persuaded to sign something you didn't want to, but is done *ENTIRELY WITHOUT YOUR KNOWLEDGE*. If you receive a text message from these people, don't ignore it. You must unsubscribe from the service to stop them from sending you texts at your expense. There will be a link to a contract in the text- it is safe to click on and gives a telephone number to unsubscribe/demand a refund/complain. This company is called SB7 Mobile Limited and the service is called Alerts4u, as is the website. The phone number for them is 02081253903.

I have reported it to Action Fraud but it seems they have been doing this for years and are still allowed to continue sadly.

I don't know if the companies who use the QR code system are aware of it, or if it is the particular QR code scanner I was using, unfortunately.

Take care if signing up using these QR code apps to download an app, even if it's a reputable company.

km1500

It is possible to paste your own qr code on top of a legitimate one eg Morrisons card.

My advice is never to scan a qr code they are insecure

MattMattMattUK

km1500 said:

It is possible to paste your own qr code on top of a legitimate one eg Morrisons card.

My advice is never to scan a qr code they are insecure

That is extreme, a QR code shows one what it is before any action is taken, just scanning it does nothing. Secondly it can only be a link, one that will open a web page, link to a Play/App store app, an email address or phone number etc. but it cannot download the app, make the call, send a message or email on it's own, that requires further user interaction and direct action.

There are reasons to be cautious when sending SMS messages to shortcode or premium numbers, but there is no reason to not scan QR codes, they do nothing on their own, one just needs to be conscious of what happens after that, the same with a typed website which could end up being mistyped, or an SMS to a random shortcode that one was unsure of.

Peter999_2

Hi Miop,

I can tell you how it has happened.   It will be the QR reader app that you have used - is it maybe an android app from the Play store?

What happens is that you install the app, see the QR code in a shop, scan the QR code in the app and then the app brings up a page which also has a link to their "scam" website.   You click on that thinking that is the supermarkets website but it's not, it's the other website that is worded to sound like the supermarkets website.

It is pretty clever really, but incredibly annoying.    This happened to my friend and they asked me for advice so I replicated what they did and worked it out what had happened.    I got her to contact Barclays and got it all sorted out (they were very good about it, and the website she'd signed up to her gave her a "generous" 4 days free subscription before she had to pay £10 a month).   Barclays ensured that it all got cancelled and no money came out.  

I have a google pixel 7 and you can go into the photo app, point it at the qr code and it gives you the link only to the valid website.  I'm not sure if other phones now do this (hers didn't).

I'm sorry you got fooled into it, but at least you picked it up very quickly.

soolin

km1500 said:

It is possible to paste your own qr code on top of a legitimate one eg Morrisons card.

My advice is never to scan a qr code they are insecure

QR codes are fine if you look at where they send you. I use a QR code daily via Inpost for parcel receipts, you point phone at QR code and it shows you the address it will take you to, nothing opens automatically on my iPhone , nothing is filled in for me I have to click on link to website, then again it shows the site I have landed on, then from there I fill in my details. I also use them a lot in restaurants where many insist on hiding their allergen menus behind a code. The process is exactly as above, I point my phone atQR code on main menu , confirm the website I’m being taken to and can check again when site has loaded. 

km1500

Not sure I agree ... Google QR code scams or, eg..


https://www.google.com/amp/s/www.thisismoney.co.uk/money/beatthescammers/article-11712823/amp/Never-heard-QR-jacking-cynical-new-ruse-steal-cash.html

Peter999_2

Soolin is completely correct, like she says, look at where it is sending you.

It's so easy to create a QRcode, takes seconds.

oldagetraveller1

If what Soolin writes is correct and there's no reason to doubt it, that linked article has to be slightly incorrect?

"and it directs you to a website automatically without you having to tap the details into your browser."

I don't think there's ever been a time when a direct connection has happened, there's always been a website link, i.e. no automatic direct, whenever I have scanned a code. I do use the camera on my phone (Android) rather than a dedicated app from Playstore.

Risking Peter's code, scanning reveals a website link .....scamyou.co.uk, not an automatic direct.

soolin

Peter999_2 said:

Soolin is completely correct, like she says, look at where it is sending you.

It's so easy to create a QRcode, takes seconds.

I’m not techie at all but when I point my camera at that it tells me it is a link to ‘iamgoingtoscamyou.co.Uk . It does not automatically direct me anywhere.

I tried a local menu as it was all I could find lying around, and again it has said the name of the takeaway and to access the site I have to click on the site name that comes up when I scan the QR code. 

glennevis

oldagetraveller1 said:

If what Soolin writes is correct and there's no reason to doubt it, that linked article has to be slightly incorrect?

Shock horror, a journalist gets it wrong.
Wouldn't be the first time.

Agree with soolin.

molerat

soolin said:

Peter999_2 said:

Soolin is completely correct, like she says, look at where it is sending you.

It's so easy to create a QRcode, takes seconds.

I’m not techie at all but when I point my camera at that it tells me it is a link to ‘iamgoingtoscamyou.co.Uk . It does not automatically direct me anywhere.

I tried a local menu as it was all I could find lying around, and again it has said the name of the takeaway and to access the site I have to click on the site name that comes up when I scan the QR code. 

Yep, I have to press the link to go there.  And if I press the 3 dots beside the address it comes up with the full address including /youwilllosealotofyourmoney.

You really have to make an effort to go to the scam site unless of course you go round blindly pressing anything that pops up.