QR code scams: how to spot them and what to do

Before you scan, check where the code will take you.

The answer in 2 lines. A QR code can send you to a fraudulent payment or login page. Be cautious with unexpected codes in messages and stickers attached to parking equipment. Check the destination address before opening it, then verify the payment route independently. If you entered card details, contact your bank immediately. Simply scanning a code does not automatically mean your phone or bank account has been compromised.

What to do first

Inspect the sign or machine. A sticker covering another label, altered payment instructions or an unfamiliar website should make you pause.
Use your phone's built-in scanner and read the destination preview. If you cannot confidently verify the address, close it.
For council parking, check the council's own parking pages before paying. Use an independently verified payment method rather than instructions reached through the suspicious code.
If you entered banking details, contact your bank through your usual app or a number on your card or statement. Explain exactly what you entered.

Stop: danger

Stop before authorising anything: do not enter a banking approval code, approve an unexpected payment or install software to make the parking payment work. Close the page and verify the instructions independently.

Where the trap appears

Fraudsters can put their own code on parking signs or payment machines. The page may imitate a genuine parking service and collect card details without recording any parking payment. Unexpected emails can also use codes to send you to a fake login page.

The National Cyber Security Centre's QR code guidance explains the risks: use it to recognise situations needing extra caution, particularly codes in open public spaces or unexpected emails. The code's appearance cannot tell you whether the destination is trustworthy.

What to do after scanning

You only opened the page: close it. If you entered nothing and downloaded or installed nothing, further action is usually unnecessary; watch for unusual account activity.
You entered a password: change it through the genuine service and replace it anywhere else you reused it.
You entered card details or paid: contact your bank immediately and ask about securing the card and disputing the payment.
You installed software: stop using the suspicious software and follow the recovery links in the official phishing recovery guidance. Use its section matching what happened; tell your IT team if it was a work device.

What not to do

Trusting a page solely because it has a familiar logo or looks professional.
Treating a padlock or HTTPS address as proof that the organisation is genuine.
Downloading a separate scanner offered by the code you are trying to check.
Assuming a receipt from the suspicious page proves that your parking was paid.

Report it without returning to the fake page

Keep the website address, payment record and a photograph of the sign with its location. Do not scan again just to collect evidence. For lost money or an account compromised through the scam, follow the reporting link in the NCSC recovery guidance to Report Fraud.

For a code received by email or text, use the GOV.UK reporting instructions: forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726. Reporting a message does not replace contacting your bank.

Check the local parking rules

There is no single payment arrangement across England. For example, the Southend-on-Sea council warning says its parking systems no longer use QR codes. Read the warning and use the council website's parking section to check legitimate payment instructions.

Do not assume another council follows the same policy. Use the relevant council's official parking contact to report the location and machine reference. In Scotland, fraud reporting goes through Police Scotland; the recovery guidance linked above distinguishes this from England, Wales and Northern Ireland.

Good to know

QR code phishing is sometimes called quishing.
A genuine-looking sticker can still direct you to a fake website; a crooked sticker is only one possible warning sign.
A refund depends on what happened and the applicable payment rules. Do not rely on promises made by the suspicious website.

Illustrative example: Priya scans a parking sticker but notices an unfamiliar address. She closes the preview without opening the page, checks the council's parking information independently and uses a verified payment method. She reports the machine location through the council's official contact.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on 6 November 2026, for England. Confidence: high for QR phishing precautions, recovery steps and message reporting; medium for local payment arrangements, which must be checked with the relevant council.