Drivers who pay for parking at public car parks using their phones are being urged to watch out for warning signs of a rising scam. Consumer group Which? has issued an alert about fraudulent QR codes that can put personal data and money at risk.
What is the QR Code Scam?
The scam, known as 'quishing' (QR phishing), involves criminals placing fake QR code stickers over legitimate ones on parking payment signs or machines. Unsuspecting drivers scan the code, believing they are paying for parking, but are instead redirected to fake websites designed to steal credit card numbers, passwords, and other personal information.
Which? released a video on Facebook demonstrating how a fake QR code can be peeled off to reveal the real one underneath. The organisation warned that this tactic is increasingly used in public places such as car parks, restaurants, pubs, shops, bus stops, and train stations.
Five Ways to Protect Yourself
In the video, a Which? representative outlined simple steps to avoid falling victim:
- Check for tampering: Before scanning, inspect the QR code to see if it has been tampered with. If it looks suspicious, do not use it.
- Type the web address manually: Instead of scanning, manually enter the website address to ensure you visit the correct site.
- Use your phone's built-in scanner: Most phones have a scanner in the camera app. Avoid using third-party apps to scan QR codes, as they increase the risk of malware or misleading adverts.
- Preview the web address: As you scan, check the URL. If it does not begin with HTTPS, looks different, or is not the expected site, do not proceed.
- Avoid QR codes in emails: Scammers use QR codes in emails to disguise malicious links, as email security tools often do not scan images. Also, only download apps from verified stores like Google Play or the Apple App Store.
Rising Reports of Fraud
Data obtained through a Freedom of Information request to Report Fraud Intelligence Services shows a dramatic increase in QR code parking scams. In 2022, only nine cases were reported with total losses of £322. By 2025, reports surged to 133 in a single year, with victims losing £29,682. Over four years, there have been 247 reports costing drivers £56,648.
The British Parking Association also warned of fake QR codes, fraudulent Penalty Charge Notice text messages, and contactless card payment fraud. They advised drivers to remain vigilant in parking areas, as scammers may place fake codes on official signage.
What to Do If You Are a Victim
If you have fallen victim to a QR code scam, contact your bank immediately and report it to Action Fraud. If you spot a suspicious code, you can also report it to help prevent others from being caught out.
