Why Fake QR Code Parking Scams Have Soared 1,300 Per Cent in Three Years

The number of fake QR code stickers appearing on parking machines across the UK has risen by 1,300 per cent in three years, according to a Freedom of Information request submitted by road technology specialist Alisa Reliability Solutions. The scam, which has become known as “quishing,” involves criminals placing fraudulent QR code stickers over the legitimate codes on pay-and-display machines and parking meters. When drivers scan the fake code, they are redirected to a convincing but fraudulent payment website designed to capture their card details.

The RAC, which has been tracking the trend, says that drivers have lost at least £56,000 since 2022 through these scams, though the true figure is likely to be significantly higher given that many victims do not report the fraud. With millions of drivers using QR codes to pay for parking every week, the scale of the vulnerability is considerable, and experts are warning that the problem is intensifying as criminals refine their methods.

How the Quishing Scam Works

The mechanics of the fraud are straightforward but effective. Criminals print realistic-looking QR code stickers and attach them directly over the genuine QR codes on parking machines. The stickers are often indistinguishable from the real thing at a glance, and in many cases they are placed with care to align precisely with the existing label area, making them even harder to detect.

When a driver scans the code with their smartphone, they are taken to a website that closely mimics the legitimate parking payment service. The fake site asks for vehicle registration details, parking duration, and card payment information. Everything looks and behaves like the genuine service, including confirmation screens and reference numbers. The driver believes they have paid for their parking, but their card details have been captured and the parking fee has not actually been processed.

The consequences for drivers are twofold. First, they may receive a Penalty Charge Notice because their parking was never actually paid. Second, their card details are in the hands of criminals who may use them to make fraudulent purchases or sell them to other criminal networks. Cancelling the card, disputing fraudulent transactions, and dealing with the PCN can make the experience both time-consuming and stressful.

Simon Williams, head of policy at the RAC, said that “quishing” is one of the more insidious parking frauds because it exploits the trust drivers place in what appears to be official infrastructure. Drivers assume that a QR code on a machine has been placed there by the council or car park operator, and criminals rely on that assumption entirely.

How Widespread Is the Problem?

The FOI data obtained by Alisa Reliability Solutions shows that the number of quishing incidents reported to councils and car park operators has increased by 1,300 per cent over three years. While the absolute numbers vary significantly by region, fake QR codes have now been found on parking machines in cities, market towns, seaside resorts, and suburban shopping centres across England, Scotland, and Wales.

The recorded financial losses of £56,000 since 2022 represent only the cases that have been formally reported to the police or to local authorities. Fraud experts consistently note that the majority of victims do not report financial crimes, particularly when individual losses are relatively small. The average loss per incident is likely to be in the range of £20 to £50 for the parking payment itself, but card fraud arising from the captured details can run to hundreds or thousands of pounds.

Several high-profile cases have been reported in London, where the density of parking machines and the volume of daily parking transactions creates rich opportunities for criminals. However, smaller towns and tourist destinations have also been targeted, and the RAC has noted that seaside and rural areas with high visitor footfall during the summer months are particularly attractive to fraudsters, who can place stickers and move on before discovery is likely.

The rise in QR code parking fraud also reflects a broader trend in which scammers have adapted to the shift toward digital and contactless payment. As councils have rolled out QR code payment options to reduce the need for cash or expensive machine upgrades, the attack surface for this type of fraud has expanded considerably. The technology itself is not at fault, but the physical vulnerability of stickers on public machines has proven difficult to address at scale.

How to Spot a Fake QR Code

There are several practical steps drivers can take to protect themselves. The first and most important is to check carefully whether the QR code sticker on a machine looks raised, damaged around the edges, or slightly misaligned with the surface it is on. Legitimate QR codes are typically printed directly onto the machine or on a label that is flush with the panel. A sticker placed over the top will often have a slightly different texture, visible edges, or show signs of recent placement such as a lack of weathering compared with the surrounding surface.

Before entering any payment details, examine the website URL carefully. Genuine parking payment sites will typically have addresses that clearly correspond to the council or the named parking operator, such as a council name followed by .gov.uk, or a well-known parking brand. A URL with unfamiliar letters, numbers, or domains ending in .net, .info, or country codes that do not correspond to the UK should be treated with suspicion. If in doubt, close the browser and either use a different payment method on the machine or search directly for the car park operator’s website.

Many parking machines that offer QR code payment also accept contactless card payment or app-based payment. If you are uncertain about the QR code, using one of these alternatives entirely avoids the risk. Some councils and operators have also begun publishing their legitimate app and payment URLs on their signage, allowing drivers to verify the address before scanning.

If you believe you have scanned a fraudulent QR code, the immediate steps are to contact your bank to freeze or cancel your card, report the fraud to Action Fraud on 0300 123 2040 or via actionfraud.police.uk, and inform the car park operator or council so that the fake sticker can be removed. Keeping a screenshot of the fraudulent website before closing it may assist police investigations.

What Councils and Operators Are Doing

Councils and parking operators are aware of the problem, but responding to it consistently across thousands of machines in hundreds of locations is a significant operational challenge. Some authorities have begun conducting regular physical inspections of their machines, with staff instructed to check for signs of tampering. Others have begun using tamper-evident materials on machine panels to make it more apparent when something has been placed on the surface.

The RAC has called on local authorities to adopt a more systematic approach to machine inspection, and to provide clearer public information about which payment methods are official and which should be treated with caution. The organisation has also argued that councils should consider removing QR codes from machines entirely in areas where fraud has been detected, replacing them with app-based payment instructions that direct drivers to a verifiable URL or named app store download.

The British Parking Association, which represents the parking industry, has also issued guidance to its members on the threat and on measures to reduce the risk to drivers. The guidance includes recommendations on signage, machine labelling, and staff training. However, implementation remains patchy, and drivers should not assume that any particular machine has been recently inspected or secured.

Sources

RAC: QR parking scams soar in number across the UK (May 13, 2026)

Action Fraud: Report fraud and cyber crime