What is a QR code scam?

A QR code scam uses a scannable code to lead you into a fraudulent request, such as a fake payment or harmful download. This is often called quishing. Scanning is not proof of a scam: the problem is the destination or action the code directs you towards. 12

By Secordit. Last checked: 7 November 2026.

Go to the steps · All glossary terms

How it works

  1. A criminal places or sends a code that appears useful or legitimate. 12
  2. You scan it expecting parking, a document or another service. 12
  3. A fake page or app asks for information or payment. 12

Real UK example

BBC reporting in August 2026 described Les Howard scanning a parking code in Caernarfon. He encountered an unwanted payment subscription and contacted his bank.

Cyngor Gwynedd told the BBC it did not use QR codes for parking payments. It also said it had removed fake stickers. 2

Warning signs

  • A sticker looks newly placed over another payment notice. 1234
  • The opened page does not match the named operator. 12
  • You are asked to install an unfamiliar scanner or payment app. 1234
  • A parking payment turns into a subscription or unrelated charge. 1234

What to do now

  1. Stop before entering information if the destination looks wrong. 12
  2. Check parking instructions with the operator through an independent route. 12
  3. If you paid or gave card details, tell your bank and report the code to the operator. 1234

UK reporting and support

  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 345
  • Report fraud or hacking in England, Wales or Northern Ireland to Report Fraud. In Scotland, call Police Scotland on 101. 46
  • If someone is in danger, call 999. 6

How to protect yourself

  • Use your phone’s built-in camera rather than an unfamiliar QR scanner app. 12
  • For parking, use the genuine operator’s app or another listed payment method. 1234
  • Check the destination and what you are agreeing to before paying. 12

Frequently asked questions

What does quishing mean?

It is a name for phishing involving QR codes. The code directs you towards a deceptive request. 2

Are all parking QR codes fake?

No. Check the particular operator and location. In the BBC’s Caernarfon case, the council said it did not use them. 2

Can a genuine QR code still lead to a bad experience?

Yes. The BBC described a scanner app showing an unrelated link beside a genuine destination. Use the phone’s built-in scanner. 2

Matching kit

After a Scam: What to Do First · £7 · Digital download.

A printable UK checklist for the money, account and reporting steps. It is general information, not a recovery service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. Police.uk, Police are encouraging drivers to be aware of QR code car park scams | PSNI. Accessed 7 November 2026 (Europe/London).
  2. BBC News, Les used a QR code to download a parking app - but it was a scam - BBC News. Accessed 7 November 2026 (Europe/London).
  3. UK Finance, Authorised Push Payment Fraud Reimbursement | UK Finance. Accessed 7 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud alert: Police forces being impersonated in scam calls using ‘spoofed’ phone numbers - Report Fraud. Accessed 7 November 2026 (Europe/London).
  5. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 7 November 2026 (Europe/London).
  6. Police Scotland, How to report a crime - Police Scotland. Accessed 7 November 2026 (Europe/London).