Fake QR Codes at Parking Meters Have Pushed Fraud Reports Up by 1,286 Percent

Milton Haworth scanned a QR code stuck to a car park sign in Castleford to pay for parking. It signed him up to a subscription he never wanted and cost him £39. Joe Hall’s girlfriend scanned one in Luton before Christmas and lost £400 from her bank account overnight. Neither code looked fake in any way either of them could reasonably have spotted before it was too late.

Action Fraud, the national fraud reporting centre, received 1,386 reports of this exact scam last year, up from just 100 in 2019, a rise of more than thirteenfold in five years. Organised crime groups are behind the surge, according to the Chartered Trading Standards Institute, and parking meters have become one of their favourite targets.

How the Scam Actually Works

Criminals print their own QR code sticker, matched to the exact font and colours of a genuine council or private car park sign, and stick it directly over the real one. A driver in a hurry scans it, gets sent to a fake payment page that looks identical to the real parking app, and hands over card details that go straight to the scammer rather than the parking operator. Joe Hall, whose girlfriend was caught out in Luton, said the sticker was printed so precisely that four other drivers behind her in the same car park fell for the identical fake code within minutes.

Katherine Hart, lead officer at the Chartered Trading Standards Institute, said losses from this fraud have reached life-changing sums for some victims, and that the scam is significantly under-reported as the first hit is often small enough that people do not bother telling anyone. That first small payment, she said, is frequently just the setup for a second, larger scam days or weeks later, when the criminals call pretending to be from the victim’s bank, police or Trading Standards, armed with exact details of the earlier transaction to sound convincing.

Why the Codes Are So Hard to Police

A QR code sticker costs a criminal almost nothing to print and can be swapped onto a machine in seconds while nobody is watching, which makes the fraud cheap to run and difficult for any single council or car park operator to stay ahead of. Removing a sticker fixes one machine for one day. It does nothing to stop the same gang printing another batch and targeting a different postcode the following week. Action Fraud’s own figures, obtained by the BBC’s Shared Data Unit, show recorded incidents more than doubled in the UK between 2023 and 2024 alone, with a fifth of all reports over the past five years linked to the Metropolitan Police force area.

Who Is Actually Being Protected Here

National Car Parks, which runs 800 sites across the UK, confirmed two of its own car parks had been targeted by scammers and said it was reviewing whether to remove QR codes from its signage entirely, relying on its website instead. Councils across the country have issued their own warnings after fake codes turned up on their machines, and Aberdeen North MP Kirsty Blackman has personally removed fraudulent stickers from parking machines in her constituency, saying the problem is a real challenge to solve, as organised criminals simply reappear elsewhere.

Milton Haworth, the driver caught out in Castleford, said he has refused to use a QR code from that day on, and believes authorities are not treating the fraud seriously enough as individual losses look small next to multimillion-pound cases. “If it’s £39 a month, what if there’s a million people being duped?” he asked. Detective Superintendent Gary Miles, head of the National Fraud Intelligence Bureau, said fraudsters keep finding new ways to exploit QR codes across everyday life, and urged drivers to stop and check before scanning rather than assume a code on official-looking signage is genuine.

The Detail That Gives Fake Codes Away

A pasted-on sticker sits proud of the surface underneath it, unlike a code printed directly onto laminated signage. Run a finger over any QR code before scanning it. A raised edge, a slightly different shade of white behind the code, or a corner that lifts when you press it are the clearest signs a sticker has been placed over the original.

Genuine council and private parking apps use a small number of recognised platforms, such as RingGo, PayByPhone or JustPark. If the QR code takes you to a payment page or app you do not recognise, or asks you to download something before you can pay, stop immediately rather than continuing simply as you are in a hurry to get back to the terminal or the shops. Legitimate parking payment never requires downloading a separate app mid-transaction just to “verify” your bank details.

Not Just Parking

Parking is the most common target, as it combines two things scammers need: a driver under time pressure and a payment made in the open, on a public street, where a sticker can sit undetected for days or weeks. But the same technique now turns up on restaurant tables where the code was supposed to open a menu, on parcels left at the door claiming a redelivery fee is owed, and even briefly on a television broadcast, where a fraudulent code was shown on screen in a live segment. Anywhere a legitimate business trains customers to scan first and think second, a criminal has an opening to exploit that habit.

How to Fight Back

Before you scan any parking QR code, look up the car park operator’s official app or website separately, using a search engine rather than the code itself, and pay through that instead. Most car parks display the operator’s name on the entrance sign or ticket machine, and every major UK parking app can be searched for and installed in advance so you are never relying on a code you cannot verify in the moment.

If you have already scanned a suspicious code and entered payment details, contact your bank immediately to report the transaction as fraudulent and ask for the card to be blocked, as acting within hours rather than days significantly improves the chance of recovering the money. Report the incident to Action Fraud at actionfraud.police.uk or by calling 0300 123 2040, however small the amount lost feels, as these individual reports are what the National Fraud Intelligence Bureau uses to identify and shut down the gangs behind the wider pattern.

Photograph any suspicious sticker before you leave, including a close-up showing its edges against the surface underneath, and report it directly to the car park operator or the council that owns the site so the physical sticker can be removed before the next driver falls for it.

If you realise your payment went to an unrecognised app or website rather than the operator’s real one, check your bank statement over the following weeks for a second, larger transaction, as that delayed second scam is the pattern fraud investigators say catches out the most people. If you are contacted afterwards by someone claiming to be from your bank, the police or Trading Standards asking you to move money or confirm card details over the phone, hang up and call the organisation back directly using a number you find independently, not one the caller gives you.

Sources:

• QR code ‘quishing’ scams up 14-fold in five years, BBC
• Action Fraud, National Fraud Reporting Centre