What are the red flags of this scam?

The QR code is a sticker visibly placed on top of another code or label — check the edges before scanning • After scanning, the URL in your browser bar does not match the official name of the car park, charging network, or organisation • The page asks for full card details (number, expiry, CVV) rather than using Apple Pay or Google Pay • An email asks you to scan a QR code rather than click a link — this is done deliberately to bypass corporate spam filters • The QR code is in a PDF email attachment claiming to be from HMRC, your bank, Microsoft 365, or a parcel courier • After scanning, the site asks you to download an app to proceed with the payment or verification

What should I do if this happened to me?

Before scanning any QR code in a public place, look closely — if it is a sticker on top of another sticker or code, do not scan it • After scanning, check the URL that appears in your browser before entering any information. If it doesn't match the car park, charging network, or organisation's real domain, close it immediately • For parking payments, download the official parking app (NCP, RingGo, PayByPhone, JustPark, etc.) in advance — do not rely on a QR code on the machine • Never scan a QR code embedded in an email to access your bank or HMRC account — go directly to the official website in a new browser tab • If you entered card details on a fake page, contact your card issuer immediately to report fraud and request a replacement card • Report suspicious QR codes to the venue, the car park operator, or your local council, and report the fraud to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.

MEDIUM phishing Last reported: 30 Sept 2026 Share

A QR code on a parking meter, EV charger, or email takes you to a site that steals your card details

Q: Is this a scam?

Yes. This is a documented scam pattern. Fraudsters paste fake QR code stickers over legitimate codes on parking machines, EV charging points, and restaurant menus — or embed malicious QR codes in phishing emails. Scanning the fake code opens a convincing payment or login page that captures your card details or credentials. Action Fraud received 784 reports and nearly £3.5 million was lost in one year.

Fraudsters paste fake QR code stickers over legitimate codes on parking machines, EV charging points, and restaurant menus — or embed malicious QR codes in phishing emails. Scanning the fake code opens a convincing payment or login page that captures your card details or credentials. Action Fraud received 784 reports and nearly £3.5 million was lost in one year.

Also known as: quishing UK, fake parking QR code, QR code phishing, QR sticker scam, EV charger QR fraud

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Before scanning any QR code in a public place, look closely — if it is a sticker on top of another sticker or code, do not scan it
2 After scanning, check the URL that appears in your browser before entering any information. If it doesn't match the car park, charging network, or organisation's real domain, close it immediately
3 For parking payments, download the official parking app (NCP, RingGo, PayByPhone, JustPark, etc.) in advance — do not rely on a QR code on the machine
4 Never scan a QR code embedded in an email to access your bank or HMRC account — go directly to the official website in a new browser tab
5 If you entered card details on a fake page, contact your card issuer immediately to report fraud and request a replacement card
6 Report suspicious QR codes to the venue, the car park operator, or your local council, and report the fraud to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.

Red flags

⚠ The QR code is a sticker visibly placed on top of another code or label — check the edges before scanning
⚠ After scanning, the URL in your browser bar does not match the official name of the car park, charging network, or organisation
⚠ The page asks for full card details (number, expiry, CVV) rather than using Apple Pay or Google Pay
⚠ An email asks you to scan a QR code rather than click a link — this is done deliberately to bypass corporate spam filters
⚠ The QR code is in a PDF email attachment claiming to be from HMRC, your bank, Microsoft 365, or a parcel courier
⚠ After scanning, the site asks you to download an app to proceed with the payment or verification

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Sources