Detecting Fake QR Codes Using Information from Error-Correction

In 2018, Takita et al. proposed a construction method of a fake QR code by adding stains to a target QR code, that probabilistically leads users to a malicious website. The construction abused the error-correction of error-correcting code used in the QR code, namely, the added stains induce decoding errors in black and white detection by a camera, so that the decoded URL leads to the malicious website. Also, the same authors proposed a detection method against such fake QR codes by comparing decoded URLs among multiple QR code readings since the decoded URLs may differ because of its probabilistic property. However, the detection method cannot work well over a few readings. Moreover, the proposed detection method does not consider the environmental or accidental changes such as sudden sunshine or reflection, nor recognizes the fake QR code as non-fake when the probability is low. This paper proposes new detection methods for such fake QR codes by analyzing information obtained from the error-correcting process. This paper also reports results from implementing the new detection methods on an Android smartphone. Results show that a combination of these detection methods works very well compared to when using only a single detection method.