QR Code Scams - Quishing

QR Code Scams: What You Need to Know

QR codes are now part of everyday life — from menus in restaurants to check-ins and car park payments. But now, criminals are exploiting our trust in this technology to commit fraud, steal personal data, and empty their victims bank accounts.

This type of fraud is often called "quishing" — short for QR phishing — where criminals replace or cover legitimate QR codes with fake ones to mislead users into visiting fraudulent websites.

Real Cases from Across the UK

• • • In Warwickshire, Trading Standards reported criminals placing fake QR code stickers on car park meters to redirect drivers to counterfeit payment pages, stealing financial details in the process.
    • In Thornaby, a woman had £13,000 stolen after scanning a QR code at a railway station which took her to a fake payment site.
    • A Kent resident received a scam letter claiming to be from Ofgem, with a QR code on the back for bogus debt payment.

QR fraud is not just digital — it’s physical, too, often using printed codes placed in public spaces like car parks or letters through your letterbox.

How Do QR Code Scams Work?

Criminals stick fake QR codes over genuine ones, often using stickers or printed labels that look official. When scanned, the code leads to a fraudulent website that looks like a trusted brand — a parking company, a government agency, or a payment portal.

From there, victims might enter credit card or bank details, download malware onto their phones or unknowingly sign up to costly subscriptions.

Because QR codes aren't human-readable, we often scan without checking — which is exactly what criminals rely on.

How to Protect Yourself ?" Apply the C.O.D.E. Test

Shared by Halton Trading Standards, the C.O.D.E. test is a helpful way to assess QR codes before you scan them:

• • • C - CONSIDER the source. If the QR code came via an unexpected email, message, or letter, pause before scanning.
    • O - OBSERVE its location. Is it a sticker? Is it placed in a strange spot? Does it cover another code?
    • D - DESTINATION: When the code opens a link, check the web address carefully. Look for correct spelling and a secure ‘https://’ connection.
    • E - EXAMINE the physical code. Does it match the branding of the business? Are there signs of tampering?

Additional Tips to Stay Safe

• • • Be wary of QR codes from strangers or in unexpected messages (especially on WhatsApp, email or social media).
    • Stick to official apps — if a car park uses an app like RingGo or PayByPhone, download it directly from the App Store or Google Play.
    • Look for signs of tampering on car park machines or public posters.
    • Report anything suspicious to Trading Standards or Action Fraud.

Final Word

QR codes are convenient, but they’re not without risk. Take a moment to check — especially when money or personal information is involved. Remember, criminals rely on us acting quickly without thinking. By staying alert and sharing this information with friends, family, and colleagues, we can help protect each other.

Think you've been caught out?

Contact your bank immediately and report the incident to Action Fraud at www.actionfraud.police.uk or by calling 0300 123 2040.

For consumer advice, call Citizens Advice Consumer Helpline on 0808 223 1133.

Please watch this short video from Which? which highlights how to spot a fake QR code: