Fake QR stickers on car park machines steal card details and enrol victims in bogus subscriptions — scams up 1,300%

What is this scam?

Car park 'quishing' — the use of fake QR code stickers physically placed over legitimate payment codes on parking machines, hospital car parks, and street signage — has surged 1,300% since 2024, with nearly a third of all UK councils affected. Action Fraud received almost 800 reports over 12 months, with victims collectively losing £3.5 million. Victims who scan the fraudulent code are taken to a professional copycat parking payment site that steals card details and often silently enrols them in recurring subscriptions of up to £19.99 per month. The safest approach is to pay using the car park's official app or physical contactless payment at the machine rather than scanning a QR code.

Example scam message

Red flags to look out for

• The message creates urgency — threatening a fine, missed delivery, or account closure.
• Links lead to unofficial domains that don't match the real company's website.
• You weren't expecting this message and can't verify the event it references.
• It asks you to confirm payment details or personal information via a link.
• The sender's number or email address doesn't match the company's official contact.

What to do if you receive this

1. Do not click links or call numbers provided in the message.
2. Contact the organisation directly using details from their official GOV.UK page.
3. Forward the message to 7726 or email report@phishing.gov.uk.
4. Report it to Action Fraud at actionfraud.police.uk.