QR Code Scam in UK Car Parks – How to Protect Yourself from Quishing

Parking in the UK has a hidden risk: fraudsters targeting drivers with QR code scams that steal card data. The QR scam, otherwise known as quishing, has affected over 400 car parks as of June 2025. Unfortunate victims are likely to lose more than £100 each, so we’ve put together some clear advice on how to avoid the “Quishing” scam.

Many councils and over a dozen hospital car parks have faced these scams, with victims often being unaware until long after they’ve lost money. Knowing how to protect yourself from scam QR codes can keep your wallet safe, and if you’ve mistakenly shared financial information, taking the proper steps can mitigate losses.

Quishing (phishing using QR codes) relies on criminals placing fake QR code stickers over genuine pay-by-phone signage or alongside parking machines.

Scanning these codes takes drivers to cloned payment sites that capture card details. Typically, the scam begins with a small charge, making the drivers think they’ve paid for the parking ticket. But it gradually escalates into monthly subscriptions or a significant unauthorised transaction.

Here are some measures for protection against QR code scams:

For maximum safety, always use a genuine parking app like RingGo, PayByPhone or Twinpay to pay for your parking, and don’t trust a public QR code to take you to a legitimate website. Although QR codes are convenient, they aren’t as safe as the official parking app or website.

Preview the QR code’s full destination URL using your device’s QR code scanner app (or a trusted third-party scanner app). Check whether the URL matches your parking provider’s domain. You can also use a link checker to confirm whether the link is malicious.

Check QR code stickers for signs of tampering, like stacked stickers, uneven edges, or mismatched fonts and colours. However, keep in mind that even a flawlessly designed QR sticker can direct you to a cloned payment page.

If you think there’s a QR code scam happening, take a photograph and send it to the local council’s fraud department. This can help save other less savvy than you.

Check your bank statements regularly to catch recurring charges that may indicate you’ve unknowingly subscribed to a fraudulent service.

Taking these countermeasures can help prevent further financial loss if you’ve engaged with a scam QR code:

Multiple Councils have issued alerts regarding quishing scams:

Westminster City Council: “The council does not use QR codes for payment on its pay-to-park signage, and the only way to pay for parking is through the RingGo app, by phone or by Parking Card.”

Warwickshire County Council: “Warwickshire Trading Standards are advising motorists not to scan any QR codes or bar codes that may appear on Pay and Display machines. Instead, download the genuine parking app (RingGo, PayByPhone, twinpay etc.) in use at the car park from your phone’s app store and use this, or pay directly by card or cash...”

Dorset Council, Bournemouth, Christchurch & and Poole (BCP), among many others, have all reported multiple car parks targeted in the past year.

Even savvy drivers may not be able to avoid being scammed, but these preventive steps can help keep you from losing money.

Always opt to pay through genuine parking apps rather than QR codes, and report suspicious codes to your local authorities. Importantly, you’ll want to look out for the other parking scams that are rising in the UK. Learn how to protect yourself from fake PCN scam text messages.

Alternatively, check out our guide on the Best Breakdown Cover companies.