If you took out your smartphone to scan Coinbase’s Super Bowl ad—a QR code that floated across the TV screen—you weren’t alone.
Coinbase says its Super Bowl ad sent over 20 million hits to the company’s website, which briefly crashed on Sunday night due to high traffic load. “We had over 20M hits on our landing page in one minute,” tweeted Surojit Chatterjee, the cryptocurrency exchange’s chief product officer. “That was historic and unprecedented.”
The ad stood out during Sunday’s Super Bowl event by featuring only a QR code that mysteriously bounced across a black screen for nearly a minute. At first, all you hear is 80s-inspired, electronic background music.
Hence, curiosity likely triggered millions of Americans to pull out their phones and scan the QR code. Only in the ad’s final seconds is it revealed the TV commercial is for Coinbase. If you scanned the code, you were taken to a special Coinbase site, which offered $15 in Bitcoin for signing up for the cryptocurrency exchange. Existing members, meanwhile, got the chance to win $3 million in prizes.
The ad was certainly a hit for Coinbase, a company that’s trying to take cryptocurrency mainstream. However, the TV commercial also shows it’s easy to trick millions of Americans into scanning a QR code, which could be bad if it led to a malicious website.
Last month, the FBI warned the public to guard for scammy QR codes. That’s because criminals can circulate look-alike QR codes to try and trick unsuspecting users into loading up scam websites. For example, a QR code can be designed to lead you to a seemingly legitimate website from a company you trust. But in reality, the landing page has been designed to log your email address, password, or credit card information and hand it off to scammers.
Security experts and cryptocurrency users also worry scammers will try to exploit Coinbase's Super Bowl ad. This could involve circulating spoofed QR codes that lead unsuspecting users to a look-alike website, which is actually malicious. So be careful around future QR codes that claim to come from Coinbase.
Still, it’s important to note scanning a QR code itself is harmless. The technology is essentially a barcode; once scanned, it will decode into a URL your smartphone can navigate to with a single tap. The resulting URL is what could lead you to a phishing site or malware posing as an app.
So to protect yourself, you should double-check the URL from a scanned QR code to make sure it looks authentic. If something is misspelled, or the domain looks wrong, then it's better to avoid the website. Another tip is to consider bypassing the QR code itself, and checking the vendor's social media pages or official websites through a browser first.