QR Code Scam UK: Spot a Fake 'Quishing' Code
A QR code hides its destination until you scan it — that's exactly what makes a fake one dangerous.
What a QR code scam ('quishing') looks like
This scam is a fake QR code, often stuck over a genuine one on a parking meter or car park sign, that leads to a convincing but fraudulent payment page instead of the real one. A similar pattern uses a QR code inside an email or text to lead to a phishing site. NCSC uses the term "quishing" for QR-code phishing.
Why QR code scams work
A QR code gives no visual clue about its destination the way a suspicious-looking link normally would, so it bypasses the instinct to check a web address before clicking. In emails, a QR code can also slip past some security tools that are better at spotting suspicious text links than suspicious embedded images.
Signs a QR code might be a scam
- A sticker looks like it has been placed over another code — check for a raised edge, different finish, or air bubbles.
- A car park or payment machine has no other obvious way to pay except by scanning a QR code.
- A QR code arrives in an unsolicited email, text, or parcel you weren't expecting.
- The code appears somewhere it wouldn't normally be needed, or looks out of place compared to official signage.
How the scam works step by step
First, a fake QR code is placed over a genuine one, or sent in a message. Second, scanning it takes you to a convincing but fake payment or login page instead of the real destination. Third, you enter card or login details, which are captured directly. Fourth, your money may be taken, no genuine payment such as parking is ever made, or your account details are used elsewhere.
How to check a QR code safely
Use your phone's own built-in camera or scanner rather than a third-party app, so you can preview the web address before opening it.
- Look closely for signs a physical code has been stuck over another one.
- Never enter payment or login details on a page you reached by scanning an unexpected QR code.
- If you're unsure at a car park, use the official app or website for that car park instead of scanning a code.
If you've already scanned and entered details
If you entered payment details, contact your bank immediately and ask them to watch for unauthorised transactions. If you entered a password, change it straight away, especially if you've reused it elsewhere.
How to report a QR code scam (UK)
Report a tampered physical QR code to the site owner, such as the council or car park operator, as well as to Report Fraud at reportfraud.police.uk or 0300 123 2040 if you're in England, Wales, or Northern Ireland. In Scotland, report to Police Scotland on 101.
Frequently asked questions
What does "quishing" mean?
It means QR-code phishing — using a fake QR code to lead someone to a fraudulent website instead of the genuine one.
Where are fake QR codes most commonly found in the UK?
Parking meters and car park payment signs are the most consistently documented UK setting, where a fraudulent sticker can be placed over the genuine code. Codes in unexpected emails or texts are another route.
How can I tell if a QR code sticker has been tampered with?
Look for a raised edge, a different finish or colour, or air bubbles suggesting a sticker has been placed over the original code.
I scanned a fake QR code and entered my card details — what do I do?
Contact your bank immediately and ask them to monitor your account for unauthorised transactions.
How do I report a fake QR code?
Report a physical tampered code to the site owner, such as the car park operator, and report it to Report Fraud at reportfraud.police.uk or 0300 123 2040 (Police Scotland on 101 in Scotland).