Scam alert: bogus QR codes continue to target motorists

Police forces and local councils have aired warnings about scam QR codes continuing to catch motorists out.

Quick Response (QR) codes are those black and white patterned squares you scan with a smartphone, which then direct you to a website. They have become a popular tool for scammers, with reports to Action Fraud about all QR code scams, not just parking, more than doubling in 2024 to 1,386.

These nasty scams can convince you to scan a dodgy QR code with your phone to pay for parking, only to sting you with a monthly subscription trap after gathering your personal and financial details.

Eleven local councils and police forces have taken to social media recently to share warnings far and wide about QR code scams appearing.

Here, we look at recent reports of QR code scams, explain what typically happens and how to avoid scanning a dodgy QR code. 

Sign up for scam alerts

Our emails will alert you to scams doing the rounds, and provide practical advice to keep you one step ahead of fraudsters.

Sign up for scam alerts

Malicious QR codes

Which? has been sharing reports of QR code parking scams for almost two years, but these scams continue to catch out motorists. 

Derbyshire police reported scam QR code stickers appearing at a pay-and-display car park in Derby. The QR code had been applied to a pay-and-display machine and scanning the code led to a website registered in Germany, which is no longer live.

North Wales Police has also warned that dodgy QR codes are on the rise and have been found on restaurant menus, public transport timetables and car parks. 

Nine councils across the UK have recently reported that QR codes have been left in council car parks on pay-and-display machines and parking boards. Bridgend County Borough Council warned that some QR codes led to fraudulent websites. These were found to be impersonating legitimate parking payment platforms RingGo and PayByPhone.

Previous Which? QR code scam investigations have found that these scams can be used to disguise phishing websites, misleading adverts, subscription traps or to infect your device with malware. 

• Read more: what are QR codes and are they safe to use?

How to tell if a QR code is safe

Always follow these six checks before you scan a QR code:

1. Look for evidence of tampering – can you see that they’ve been stuck over something? If in doubt, enter the website address manually.
2. Avoid using an app to scan QR codes because it can increase the risk of downloading malware or being redirected to a misleading advert. Most phones have a scanner built into the camera, so use this instead.
3. Preview the address before following it. When you scan a QR code, the address should come up before you’re redirected to it.
4. Use a verified app store (Play Store at play.google.com or App Store at apps.apple.com) to download apps instead of using a QR code as the latter is less trustworthy and could lead to malware being downloaded to your device.
5. Avoid QR codes in emails as these could be used by scammers to disguise phishing links.
6. Check the display board in car parks to see how you can pay for parking.

If you lose any money to a scam, call your bank immediately using the number on the back of your bank card and report it to Action Fraud, or call the police on 101 if you’re in Scotland.