Fake QR codes on parking machines: how to spot the 'quishing' scam and what to do

What's happened

Fake QR code stickers have turned up on parking ticket machines in Perth, the latest in a run of so-called "quishing" scams aimed at drivers. Perth and Kinross Council first warned people on 29 September after a sticker was found at the Library East car park. By 6 October, stickers had been found on machines at five city centre car parks: South Inch, South Street, Scott Street, Library East and Hospital Street.

The council's message is blunt: "Please do not scan any QR codes on parking machines." It says drivers should pay with coins, a card or the official RingGo app, and points out that RingGo does not use QR codes for parking payments. RingGo told The Courier that imitation scams are a "daily" and "ongoing issue".

It isn't just Perth. Reports of QR code scams to Action Fraud rose from 100 in 2019 to 1,386 in 2024, according to data obtained by the BBC's Shared Data Unit. That's about 3,000 reports since 2019, and the number more than doubled between 2023 and 2024. Which? says Action Fraud put losses to QR code scams at £3.5m in 2024. Katherine Hart of Trading Standards says the true scale is likely to be much bigger because so few people report it. With Citizens Advice's Scams Awareness fortnight running from 12 to 25 October, it's a good time to know the signs.

The warning signs

• A sticker on top of the machine or sign. Fraudsters print their own code and stick it over a genuine one, or on a blank part of the machine. Raised edges or a code that looks newer than the sign are red flags.
• A QR code where the council says it doesn't use them. Many councils, including Perth and Kinross, say they don't take parking payments by QR code at all. Which? has also reported fake stickers that copy the RingGo logo.
• A web page instead of the app. Scanning a fake code usually opens a payment page in your browser that asks for your card details.
• An odd web address. Your phone usually shows the address before it opens it. Misspellings, extra words or an unfamiliar ending are all reasons to stop.

What it could cost: a worked example

This is an illustration, not a real case. Sam scans a code on a council car park machine and pays £4.50 for three hours on what looks like the usual payment page. The money goes to fraudsters, so Sam hasn't actually paid for parking.

A council parking ticket in England outside London is £70 for higher-level offences or £50 for lower-level ones, halved if you pay within 14 days (21 days for some councils). So Sam could be out £4.50 plus a £35 to £70 parking ticket before the bigger risk: the criminals now have Sam's card number, expiry date and security code.

That's where the real money goes. Action Fraud's £3.5m of losses in 2024, spread across 1,386 reports, works out at roughly £2,500 per report on average. That's our rough sum, not an official figure.

How to check if something is genuine

1. Skip the code. Pay with cash or card at the machine, or open the parking app you already have. If you need the app, download it from the App Store or Google Play, not from a link or code.
2. Read the sign, not the sticker. The location code you enter in the app is printed on the official sign. You don't need to scan anything to use it.
3. Check the address before you tap. If you do scan a code anywhere, look at the web address your phone shows and only carry on if it's exactly what you'd expect.
4. Tell the car park owner. Report any sticker to the council or operator named on the sign.

What to do if you've been caught

1. Call your bank straight away using the number on the back of your card, or call 159 to reach your bank's fraud team. Ask them to block the card.
2. Report it to Report Fraud on 0300 123 2040 or online. In Scotland, call Police Scotland on 101.
3. Forward scam messages. Send suspicious texts to 7726 for free, and forward suspicious emails, including ones with QR codes in them, to [email protected].
4. Challenge any parking ticket that follows, with a photo of the sticker, your payment confirmation and your crime reference number.
5. Watch for follow-up contact. Once fraudsters have your details, they may text or call pretending to be your bank. Your bank will never ask you to move money to a "safe account".

Your questions answered

What is quishing?

It's phishing using a QR code. Instead of clicking a dodgy link, you scan a code that takes you to a fake website designed to collect your card or personal details.

Will my bank refund me?

If criminals use your card details to take payments you didn't authorise, your bank should normally refund you, unless it can show you were grossly negligent. Contact it quickly.

Is it only car parks?

No. Car parks are the most common place for fake codes, according to Which?, but they have also turned up in emails pretending to be from HMRC and other government bodies, and in messages to online marketplace sellers.

Sources: The Courier, Slough Observer (BBC Shared Data Unit data), Which?, Kent County Council, Citizens Advice