QR Codes: so convenient, yet so risky.

Gigabit Systems

December 16, 2024

•

20 min read

Share this post

QR Codes: so convenient, yet so risky.

Because of the surge in QR code scams, the city of Miami has been forced to take down thousands of QR codes from parking meters. Criminals have been replacing legitimate QR codes with fraudulent ones, tricking users into providing sensitive information or making payments to malicious accounts.

QR codes have made everyday tasks like paying for parking, shopping, and accessing services more convenient, but scammers are exploiting this technology at an alarming rate. Here’s what you need to know to stay protected:

1️⃣ Beware of “Quishing”:

QR code scams mimic phishing attacks, redirecting you to fake websites to steal your credentials. Always inspect the preview link before clicking. If it doesn’t look secure or official, don’t proceed.

2️⃣ Fake QR Codes in Public:

Scammers place fraudulent QR codes on parking meters, menus, or posters. If you’re scanning a QR code in public, double-check that it matches the business or service. When in doubt, manually type in the URL instead.

3️⃣ Avoid Scanning Unexpected QR Codes:

Received a QR code via text or email urging immediate action? This could be QRLJacking, where attackers create fake login portals to steal credentials. Always verify the source before scanning.

4️⃣ Be Wary of Secondhand Transactions:

QR codes used in personal sales (e.g., Facebook Marketplace) can lead to fraud. Stick to trusted payment platforms like PayPal or Zelle by navigating to their websites directly.

5️⃣ Use Built-In Camera Scanners:

Avoid downloading third-party QR scanning apps—they can be malware in disguise. Most smartphones already have QR scanning capabilities in their native camera apps.

6️⃣ Enable MFA (Multi-Factor Authentication):

Even if attackers grab your login credentials through a QR scam, MFA can block unauthorized access. Add this extra layer of protection to all your accounts.

7️⃣ Keep Your Software Updated:

Outdated systems are an open door for hackers. Keep your phone and apps updated to protect against vulnerabilities.

⚠️ Pro Tip: When in doubt, always navigate directly to the official website instead of relying on a QR code.

QR codes are incredibly convenient, but their growing use comes with great responsibility. Stay informed, stay cautious, and help spread awareness to protect yourself and others.

====================================

Follow me for mind blowing information and cybersecurity news. Stay safe and secure!

====================================

#CyberSecurity #QRCodeScams #OnlineSafety #Quishing #Miami #StayVigilant #HolidaySecurity #technology #data

Share this post

See some more of our most recent posts...

Technology

Cybersecurity

Tips

Must-Read

Your Phone Number Is a Skeleton Key Stop Handing It Out

July 14, 2025

•

20 min read

Your Phone Number Is a Skeleton Key—Stop Handing It Out

Your phone number is more than a contact detail. It’s a gateway to your entire digital identity—and for hackers, it’s the easiest way in.

The Hidden Risk Behind SMS-Based Two-Factor Authentication (2FA)

Two-factor authentication (2FA) is one of the most widely recommended defenses against account takeovers. But when your second factor is an SMS text message, you’re not nearly as secure as you think. That’s because mobile phone numbers can be hijacked—and once that happens, attackers can intercept those 2FA codes, impersonate you, and access your most sensitive information.

This is exactly what happens in a SIM swap attack—a growing threat with serious real-world consequences.

What Is a SIM Swap Attack?

A SIM swap attack occurs when a scammer convinces your mobile carrier to transfer your number to a new SIM card they control. They may use stolen personal information—like your name, birthday, address, or even leaked Social Security number—to impersonate you in a call or chat with customer service.

Once your number is ported over, your real phone loses service—and the attacker receives all your incoming texts and calls. This includes:

Login codes from your bank
Password reset links from your email provider
Security alerts from work systems
Voicemail access and call-forwarding controls

With this power, the attacker can quickly take over your email, financial accounts, and even enterprise systems tied to your identity.

Real Victims. Real Losses.

In 2023 alone, the FBI reported over $50 million in losses from SIM swap attacks. In one high-profile case, a crypto investor had his wallet drained while flying cross-country. He lost service mid-flight and landed to find his exchange accounts emptied. He’d been SIM-swapped while offline.

In another case, attackers used SIM swap access to impersonate a tech executive—convincing business partners to send funds to fraudulent addresses, totaling over $450,000 in stolen assets.

This isn’t a fringe problem—it’s organized, scalable cybercrime. And anyone with a phone number is a potential target.

Why SMS Is So Easy to Exploit

No encryption: SMS is not end-to-end encrypted. Your messages travel across networks in plaintext.
Carrier vulnerabilities: Mobile providers vary widely in how well they verify identity. Some still fall for basic impersonation or social engineering.
SS7 flaws: The global signaling system (SS7) that routes SMS and calls has known vulnerabilities that can be exploited to intercept messages.
Recycled numbers: Carriers routinely recycle old numbers. If you don’t update your accounts after changing numbers, the new owner could receive your 2FA codes.
Phone malware: If your device is compromised, hackers can steal SMS codes directly—even without a SIM swap.

Safer Alternatives to SMS-Based 2FA

1. Authenticator Apps

Apps like Google Authenticator or Microsoft Authenticator generate time-based, offline codes on your device. They’re not tied to your phone number and can’t be intercepted via SIM swap.

2. Hardware Security Keys

Physical devices like Yubikey or Titan Security Key plug into your computer or pair with your phone. They require physical presence to log in—offering near-unbreakable protection against phishing and interception.

3. Separate 2FA Devices

High-risk users (executives, admins, compliance officers) should consider having a dedicated 2FA device—a second phone number or authenticator not used for calls, email, or browsing.

4. Proxy Emails and Phone Numbers

Use unique email aliases or masked phone numbers for account signups. Services like SimpleLogin or AnonAddy allow you to create and manage these securely, keeping your real identity protected.

Carrier Security Settings You Should Activate Right Now

AT&T:

Wireless Account Protection Lock
Enables additional verification before port-outs or SIM changes
Manage in the AT&T app or online portal

T-Mobile:

Port Validation & Account Lock
Prevents unauthorized number transfers
Configurable in your account settings

Verizon:

Number Lock & SIM Protection
Blocks SIM swaps and delays suspicious account changes by 15 minutes
Enabled via the MyVerizon app

Don’t Trust Your Device Blindly

Even with good 2FA, a compromised phone can undo all your efforts. Infostealing malware can:

Read your messages
Harvest session tokens
Record keystrokes and clipboard data
Upload login credentials and cookies to criminal servers

Run regular antivirus scans. Avoid sideloading apps. Monitor activity via mobile threat detection tools like Lookout or Zimperium if you’re in a regulated industry.

The Bigger Picture: A Culture of Caution

Protecting your identity isn’t about fear—it’s about friction. Good cybersecurity introduces just enough friction to slow down attackers while keeping your workflows usable.

For businesses, that means:

Enforcing app-based or hardware MFA for sensitive logins
Educating employees about SIM swaps and social engineering
Monitoring for leaked credentials using services like HaveIBeenPwned or SpyCloud
Using advanced endpoint and mobile device management (MDM) tools

70% of all cyber attacks target small businesses. I can help protect yours.

#SIMSwap #CyberSecurity #2FA #IdentityProtection #ManagedIT #DataBreach #SMBSecurity #InfoSec

Technology

Cybersecurity

Tips

It’s not a trend. It’s the end of passwords

July 13, 2025

•

20 min read

Say Goodbye to Passwords

Passkeys are rewriting the rules of authentication — and they don’t care about your memory.

For decades, passwords were the gatekeepers of the internet — and our downfall. Weak, reused, and phished credentials have enabled breach after breach, turning humans into the weakest link in cybersecurity. But in 2025, a different kind of key is rising: the passkey.

Driven by the FIDO Alliance and backed by Apple, Google, and Microsoft, passkeys use public key cryptography to eliminate the need for shared secrets altogether.

Let’s break it down.

What Are Passkeys?

Passkeys are digital credentials that replace passwords entirely. Unlike passwords, they’re not stored on websites. They’re created and stored securely on your device or credential manager, and never transmitted — not even during login.

Instead of “knowing a password,” users simply authenticate using biometrics (fingerprint, face ID) or a device PIN. Behind the scenes, the process relies on cryptographic key pairs.

How It Works (Simplified)

You register with a website: Your authenticator (e.g., Bitwarden, iCloud Keychain) creates a public/private key pair.
The private key stays with you: It’s stored securely and never shared.
The public key is sent to the site: The website saves this key with your account.
Next time you log in: The site sends a challenge, and your authenticator signs it with your private key. The site verifies it with your public key.

No password. No shared secret. No phishing risk.

Why SMBs and Professionals Should Care

If your business still relies on passwords, you’re a target. From healthcare and law firms to small businesses and schools, weak credentials remain the #1 vulnerability.

Passkeys reduce risk by:

Preventing phishing and smishing
Eliminating password reuse
Simplifying secure login for employees
Offering future-proof compliance and user experience

Pro Tips for Adopting Passkeys

✅ Choose a cross-platform credential manager like 1Password or Bitwarden

✅ Start enabling passkeys for supported services

✅ Don’t delete passwords — yet. Keep them as backup until adoption is widespread

✅ Download and store recovery codes securely

✅ Use hardware security keys (e.g., Yubico) for high-value credentials

The Road Ahead

Most major platforms already support passkeys, and more are joining weekly. But adoption isn’t always smooth. Expect quirks, mismatches, and transition friction. Still — like HTTPS, MFA, and endpoint protection — passkeys are a necessary step forward.

It’s not a trend. It’s the end of passwords.

70% of all cyber attacks target small businesses. I can help protect yours.

Technology

Cybersecurity

Must-Read

Tips

Protect your cell number from SIM swap attacks, here’s how

July 10, 2025

•

20 min read

Protect your cell number from SIM swap attacks, here’s how.

Locked Out? Protect Your Phone Before It’s Too Late.

SIM Swap Attacks: The Silent Heist Targeting Your Cell Number

In today’s hyper-connected world, your cell phone number isn’t just for calls and texts—it’s your digital identity. But with SIM swap attacks on the rise, hackers are exploiting phone carriers’ weaknesses to hijack numbers, bypass security, and drain accounts.

How Does a SIM Swap Attack Work?

Here’s how scammers pull it off:

They gather your personal information—like your name, birthdate, and address—from data breaches, social media, or shady online sources.
Pretending to be you, they contact your phone carrier and request your number to be “ported” to a new SIM card.
Once approved, your phone goes dark—and the hacker now controls your number.
They intercept your calls and texts, including two-factor authentication (2FA) codes, giving them access to your bank, crypto, email, and more.

Key Sign: Sudden loss of cell service for no reason? That’s your red flag.

How Can You Protect Yourself?

Most U.S. carriers now offer free protections—but you need to activate them manually:

✅ AT&T:

Wireless Account Lock

Prevents SIM swaps or number transfers.
Activate via the AT&T app or your online account.
Secure your AT&T account with a strong password & multi-factor authentication.

✅ T-Mobile:

SIM Protection & Number Porting Block

Blocks unauthorized SIM swaps or number ports.
Enable in your T-Mobile online account.

✅ Verizon:

SIM Protection + Number Lock

Prevents SIM swaps & phone number transfers.
Activate via the Verizon app or online account.
Adds a 15-minute delay for added safety if turned off.

Extra Tips to Stay Safe:

Avoid SMS-based 2FA; use authenticator apps instead.
Don’t reuse passwords across accounts.
Watch for phishing emails pretending to be from your carrier.
Regularly check your carrier settings for security updates.
Use a separate phone number for sensitive accounts when possible.

Why It Matters to SMBs, Healthcare, Law Firms, & Schools:

Your staff’s phone numbers are also keys to your business network. One weak link—like a SIM swap—could expose sensitive company data, finances, or client information.

Encourage your employees to enable carrier protections, use app-based 2FA, and regularly audit their security settings.

Tagline: 70% of all cyber attacks target small businesses. I can help protect yours.

#Cybersecurity #DataProtection #SIMSwap #IdentityTheft #MobileSecurity