The Financial Supervisory Service issued a Chuseok travel alert Wednesday warning drivers about fake gift-card QR stickers placed on expressway service-area fuel pumps, restroom doors, and picnic tables, schemes that harvest payment app credentials when travelers scan codes promising bonus holiday credits. Korea Expressway Corporation maintenance teams began sweeps with local police after reports from Gyeongbu and Honam corridor rest stops, but officials expect copycat stickers to reappear faster than crews can peel them.
How the scam works
Fraudsters print colorful stickers mimicking legitimate gift-card promotions from major retailers and mobile wallets, embedding URLs that lead to phishing pages asking for login and card details. Victims believe they unlock fuel discounts or Chuseok coupon packs; criminals instead capture credentials for immediate contactless charges before victims return to cellular coverage. Some stickers overlay genuine operator QR codes for parking payment—travelers in a hurry fail to notice mismatched domains.
National Police Agency cyber units traced recent domains to offshore hosts rotated every forty-eight hours, complicating takedowns during the long holiday when staffing is thin.
Where stickers appear
High-traffic service areas northeast of Seoul saw the first removals Tuesday night; Honam and Yeongdong routes reported similar patterns by Wednesday morning. Stickers target outdoor surfaces drivers see while refueling—pump islands, trash enclosures, and EV charger pedestals—not staffed convenience store tills where cashiers might notice tampering.
Korea Expressway Corporation contractors use solvent-safe removal kits that do not damage paint; they photograph evidence before disposal for police case files.
Official guidance
Financial Supervisory Service bulletins tell travelers to obtain gift cards only through issuer apps, bank branches, or sealed retail packaging—never through ad-hoc QR scans on highway infrastructure. Verify URLs show registered Korean financial domains; close pages that request full card PINs for “activation.” Report suspicious stickers to rest-area managers or the 1332 financial fraud hotline while noting mile-marker locations for investigators.
Korea Consumer Agency parallel notices warn that no legitimate promotion requires pre-payment of “processing fees” via wire transfer—a secondary scam once criminals have partial identity data.
Payment industry response
Major card issuers pushed in-app warnings before Chuseok outbound peaks, reminding users that rest-area parking QR codes come from signed operator portals. Naver Pay and Kakao Pay disabled deep links from unknown universal link handlers temporarily—a blunt instrument that may break some legitimate partner campaigns but blocks a class of redirect attacks.
Retailers whose brands were counterfeited on stickers sent cease-and-desist letters to domain registrars; brand protection teams cooperate with FSS holiday task forces.
Driver checklist
Before scanning any highway QR, check for official metal signage from Korea Expressway Corporation rather than vinyl stickers alone. Use contactless fuel payment inside staffed booths when unsure. If already scanned, freeze cards via issuer apps, change wallet passwords, and file police reports needed for chargeback documentation.
Families with elderly drivers should pre-load legitimate fuel loyalty apps and disable browser QR auto-open features that skip domain previews.
Enforcement limits
Expressway rest areas span hundreds of kilometers; sticker placement takes seconds while removal requires lane closures and safety vests. Police increase patrols but cannot watch every pump; CCTV at some newer service areas helps identify paste-on moments after the fact.
Organized rings treat fines as cost of business unless arrests follow; FSS coordinates with prosecutors on aggregated loss thresholds that trigger heavier charges. Regional expressway branches share sticker photo hashes in a chat channel so crews recognize repeat artwork at downstream stops before drivers scan.
Insurance fraud units note some victims later receive fake refund calls referencing the original QR theft, extending the scam chain into the week after travel when guardrails drop.
After Chuseok
Task forces will publish anonymized loss statistics and consider permanent anti-tamper QR mounts on pumps—hardware changes slower than sticker scams evolve. For this week, the message is operational: treat unknown highway QR codes like strangers offering sealed gift cards through a car window—keep driving, and use official channels when you stop.