Science and TechData Privacy and Cybersecurity


QR Codes Are Reshaping Public Transit, But Are They Safe?

QR codes are great for concert tickets and sporting events, but are they practical for city buses and subways?
Posted at 8:01 PM, Oct 03, 2022

October marks the 70th anniversary of the first bar code-type product.

And the QR code — short for quick response — is an evolution on bar codes that are often used to point users to a specific website or app. 

They've also been used increasingly often as tickets for things like concerts, sporting events, flights and public transportation. In the early phases of the COVID-19 pandemic, businesses often used them to go paperless and minimize physical contact. Later, they were used by some countries as a special virus pass.

However, QR codes raise some interesting questions as they become a more regular part of global life. For instance, how safe is a user's data when scanning a QR code?

Allan Liska works at the intelligence and cybersecurity firm Recorded Future, which is usually focused on corporate cybersecurity threats. He says the individual things to look out for when using QR codes are pretty similar. 

"You don't know as the consumer what that URL is," Liska said. "You get a preview in the window of a URL, but it's often a shortened URL, so that doesn't even necessarily mean anything. That is where there's potential for problems with the QR codes. That URL could be sending you someplace bad. It could be a URL that's designed to collect data for your organization."

So QR codes don't necessarily all serve the same purpose. A user might want to make sure when clicking it that it's a safe link before entering any sensitive information.

Not every QR code can be read, though, since they aren't all necessarily speaking the same language. A phone, for example, might not be able to scan the kind of QR code for a boarding pass or concert ticket. 

"If you think of it, we've had this for a while with UPC codes, right?" Liska said. "When you go to the grocery store, do they have the right software that reads those UPC codes and it's customized for each store? You scan that in, and you know that the item that it is and the price comes up and goes in your bag. They can track how much was purchased, who purchased it, how much they paid for it, etc."

In most cases, those QR codes still connect to some form of data to make them work, so even when boarding public transit, a user might be giving the transit agency that data.

Sarah Kaufman from NYU's Rudin Center for Transportation has seen it at work in and around New York City. 

"It allows more information for the transit company to provide better service, have a better sense of who's traveling where, and then be able to optimize services based on that data," Kaufman said.

Cities around the world have adopted QR code tickets for their metro systems, including Shanghai and Delhi, but you can see them stateside too. The Los Angeles metro system uses QR code ticketing, as do large commuter rail systems in the New York area like New Jersey Transit, Metro North and the Long Island Rail Road.

Plus, using the codes has some advantages, both for train operators and for riders. 

"After you purchase the ticket through the app, a QR code shows up on your screen," Kaufman said. "Because QR codes can sometimes be a little easy to fake, these apps now have the ability to have a kind of dancing QR code that can only be read by the by the train engineer's readers. This is so much better than the paper tickets that would get lost or damaged or that would require a 20-minute wait in a lineup for a ticket machine, so it's a far more efficient system."

Joshua Schank, who used to work as Chief Innovation Officer of the Los Angeles metro system, says public transit systems want to accept as many forms of payment and ticketing as possible. 

"The more you make your product accessible to everyone, the better chance you have of attracting customers," Schank said. "It's like a classic thing where people say, 'Well, why should we still accept cash? Who's going to do that?' Well, some people might, and that might not be who you think. It might be the average, occasional rider who thinks, 'I don't know how to use this thing, but I might have some cash, so I'll just use that.' When you create more ways to make it as easy as possible for your customers to pay, that actually creates additional benefits beyond just reaching hard to reach populations."

But accessibility still hangs as a question here, like if a person doesn't have a bank, a credit card or a smart phone. That can lead to a surprisingly large portion of the ridership relying on cash. 

A study sponsored by the National Institute for Transportation and Communities found that around 30% of riders — nearly a third of those they surveyed in cities in Colorado and Oregon — still relied heavily on paying cash when they boarded buses.

Because of Schank's point about systems aiming to be accessible, cash will still be expected as accepted some places, even as more metro systems move to QR codes and wireless-enabled cards.

The main issue is that it might take a little more work, like waiting in line to see a station manager or going to a local pharmacy to buy the card.

Once those users or anyone else gets on board though, there are gains. Kaufman explained one example with express buses in New York City. 

"Since New York implemented our version of Select Bus Service, which means that people pay at a machine before boarding the bus, now people can board the bus on at any door rather than just the driver's side, rather than just the driver adjacent door," Kaufman said. "That has sped up boarding by about 30%, meaning that the bus spends about 30% less time waiting for people to get on and off at every stop."