Quishing scams warning: how to spot and avoid dodgy QR codes

Fraudulent QR codes, known as quishing scams, are most commonly found in car parks as sneaky stickers placed on payment machines, according to Action Fraud.

The national fraud reporting centre has issued a warning after revealing that £3.5m was lost to reported QR code scams in 2024. 

According to Action Fraud reports, scam QR codes have also been found on online shopping platforms, with sellers receiving dodgy QR codes via email to verify their accounts or to receive payments for sold items. Some reports revealed scams impersonating HMRC and other UK government bodies.

These two-dimensional patterns of small black and white squares can be created by anyone. While many are harmless, some act as gateways into a scammer's trap.

Read on to learn how to spot and avoid dodgy QR codes.

Sign up for scam alerts

Our emails will alert you to scams doing the rounds, and provide practical advice to keep you one step ahead of fraudsters.

Sign up for scam alerts

QR code parking scams

Dodgy QR code parking scams have been reappearing across the UK. Argyll and Bute Trading Standards has warned of recent reports around Perthshire about scam QR code stickers being stuck on parking meters.

Using its logo, these stickers have been found to impersonate the parking operator RingGo. Scanning the code led to a malicious website designed to gather personal and financial details.

Southend-on-Sea City Council has also warned of QR code scams, stating that people shouldn't use QR codes to pay for parking.

It went on to say that the council doesn't use QR codes on any parking machines, parking signs or for any pay-by-phone apps.

Similarly, Aberdeen City Council has asked motorists to be aware of fake QR code stickers placed on pay-and-display parking machines.

It recently found dodgy stickers on parking signage and meters that led to phishing websites. It stated that it doesn’t use QR codes on any of its machines.

• Read more: QR codes hijacked to set subscription traps

Spotting and avoiding scam QR codes

Before scanning a QR code, you should:

• Look for tampering - can you tell that the QR code has been stuck over something? If you’re not sure, enter the website address manually and avoid scanning the code.
• Preview the website address before following it. When you scan a QR code, you should see the address pop up before you’re redirected to it. Check the address to make sure it corresponds with what you were expecting.
• Avoid scanning QR codes in public places, such as car parks. Look for alternative ways to carry out the task. If it's a car park, there should be information about other ways to pay.
• Avoid using a QR code to make a payment if you can.
• Avoid QR code scanning apps, as it can increase the risk of downloading malware or being redirected to a misleading advert. Most mobile devices have QR code readers within the phone’s camera, so use that to scan QR codes instead.
• Avoid scanning QR codes in emails, as these could be used by scammers to disguise phishing links.

If you lose any money to a scam, call your bank immediately using the number on the back of your bank card and report it to Action Fraud, or call the police on 101 if you’re in Scotland.