QR Code Scams in the UK: How Quishing Works and How to Check a Code

QR code scams, often called "quishing", hide a malicious link inside a QR code so you can't see where it leads until you scan it. In the UK they often appear as fake stickers on parking machines and in phishing emails. Before opening any code, check the web address your phone shows, and pay through official apps instead.

QR codes themselves aren't dangerous. They're just a way of storing text, usually a web address, in a pattern a camera can read. The problem is that people can't read them, so a criminal can swap a genuine code for their own and nobody notices. This guide explains the common scams, how to check a code safely, what businesses should do, and where to report quishing in the UK.

How QR code scams work

A quishing attack has the same aim as any phishing attack: get you onto a fake website and persuade you to enter card details, login credentials or personal information. The QR code is simply the delivery method.

It works for criminals for three reasons:

• You can't see the destination. A printed web address can be checked by eye. A QR code can't.
• It moves you to your phone. Phones show shorter addresses, have smaller screens and often lack the security software a work computer has.
• It can get past email filters. A QR code in an email is an image. Not every email security tool decodes images, so a link that would be blocked as text can slip through as a picture.

Common QR code scams in the UK

Fake stickers on parking machines

This is the best-known UK example. Criminals print stickers that look like official signage and place them over or next to the genuine payment instructions on pay and display machines and parking signs. The code leads to a convincing fake payment page that takes card details.

Councils across the country have issued warnings. In January 2025, Kensington and Chelsea Council reported fake codes on parking signs in at least six locations and said plainly: "Our parking system does not use QR codes at all." It also warned that drivers who pay through a fake code may still get a parking fine, because the council never received the money. Which? has reported similar stickers impersonating parking operators, and other councils saying they don't use QR codes on their machines.

Codes in emails

A quishing email typically claims your account needs verifying, a password is about to expire, a parcel is waiting, or a document needs signing. Instead of a link, it includes a QR code and asks you to scan it with your phone. Which? reported online marketplace sellers receiving codes by email that supposedly verified their accounts or released payments. Business inboxes get versions that impersonate Microsoft 365 logins, invoice portals and HR systems.

Letters, flyers and parcels

Fake letters, delivery cards and flyers can carry codes too: a "missed delivery" card through the door, a flyer offering a discount, or a letter impersonating a public body. Treat any unsolicited code with the same caution as an unsolicited link.

Restaurant tables, posters and public spaces

Anywhere codes are printed and left unattended, someone can stick a different code on top. Menus, posters, event signage and electric vehicle chargers are all possible targets.

How to check a QR code before you open it

You don't need special software to protect yourself. Most of this is about slowing down.

1. Look at the code itself. Is it a sticker on top of something? Is the edge peeling, or does it sit slightly crooked over printed text? Which? advises checking whether a code looks as if it's been stuck over something else.
2. Read the preview. iPhone and Android cameras show the web address before opening it. Read the whole domain, not just the start. paybyphone.co.uk.secure-pay.info is not PayByPhone.
3. Ask whether a code makes sense here. A council parking machine that says "Pay by app" next to a code is suspicious if the council doesn't use codes. An email from your bank asking you to scan a code is a red flag on its own.
4. Type the address yourself when paying. If you know the parking app or the company website, use that instead of the code. Which? suggests avoiding payment by QR code where you can.
5. Use your phone's built-in camera. Which? warns that some third-party scanner apps carry intrusive adverts or worse.
6. Never enter a password after scanning. If a code leads to a login page, close it and go to the service through your bookmark or app.

Check a code from an email or screenshot

If the code arrived in an email or you've taken a photo of it, you can decode it without opening the link. Our free QR code scanner decodes a QR code from a photo, a pasted screenshot or your camera and shows the full link it contains, along with warnings about lookalike domains, link shorteners and insecure http pages. You can inspect it on a large screen before deciding anything.

Once you have the address, you can check it further:

• Look up when the domain was registered with the domain age checker. A "bank" domain registered last week is a warning sign.
• See whether the link redirects somewhere else using the redirect checker. Scam links often bounce through shorteners and several hops.
• Read our guide to checking if a website is safe for the wider checklist.

Don't treat any single check as proof a site is safe. A valid SSL padlock, for example, just means the connection is encrypted, not that the owner is honest.

What to do if you've scanned a scam code

Act quickly. The order matters:

Our guide to two-factor authentication helps with the clean-up.

Where to report QR code scams in the UK

• Suspicious emails: forward them to report@phishing.gov.uk. GOV.UK says the National Cyber Security Centre investigates them.
• Suspicious texts: forward them free to 7726, which reports them to your mobile provider.
• Fraud and lost money (England, Wales and Northern Ireland): report to Report Fraud at reportfraud.police.uk or on 0300 123 2040. Report Fraud replaced Action Fraud on 4 December 2025, run by the City of London Police; the phone number stayed the same and old Action Fraud links redirect to it.
• Outside the UK: in the US, report scams to the FTC at reportfraud.ftc.gov and online fraud to the FBI's Internet Crime Complaint Center at ic3.gov; elsewhere, use your national fraud reporting service.
• Scotland: at the time of writing, report fraud to Police Scotland on 101. Scotland was expected to join Report Fraud during 2026, so check the Report Fraud site for the current position.
• Fake stickers on parking machines: tell the council or car park operator so they can remove them. Many councils have a page or email address for this.

What businesses should do

Quishing affects businesses in two ways: your staff get targeted, and criminals can tamper with codes you put out.

Protect your staff

• Mention QR codes in phishing training. Many people have learned not to click links but will happily scan a code.
• Make it easy to report. A report button in the email client and a clear "if in doubt, ask" rule work better than blame.
• Use phishing-resistant sign-in. Passkeys and app-based two-factor authentication limit the damage from a stolen password. See passkeys for business websites.
• Protect your domain. Criminals impersonate real companies. SPF, DKIM and DMARC make it harder to send fake email from your domain; our guide to stopping email spoofing explains how.

Protect the codes you publish

If you use QR codes on menus, packaging, posters or invoices:

• Point codes at your own domain. A code that leads to yourbusiness.co.uk/menu is easier for customers to trust than an unfamiliar shortener. Our free QR code generator creates codes that link directly to the address you choose.
• Print the web address next to the code. Customers can type it instead, and they can compare it with what their camera shows.
• Check printed codes regularly. Staff should look for stickers placed over your codes, especially on outdoor signage.
• Avoid using codes for payments where you can. If you must, link to your established payment page and say so clearly on the sign.
• Don't ask customers to scan codes from emails to log in or pay. It trains them into exactly the behaviour scammers exploit.

Make It Flow helps businesses automate everyday workflows, and we're careful that customer-facing automations, such as booking confirmations and payment links, come from your own verified domain for exactly this reason.

FAQ

What is quishing?

Quishing is phishing using QR codes. Instead of a clickable link, the scammer gives you a QR code that leads to a fake website designed to steal card details, passwords or personal information. Because you can't read a QR code by eye, it's harder to spot than a suspicious link, and it can sometimes get past email filters.

Can you get hacked just by scanning a QR code?

Scanning a code doesn't usually harm your phone by itself. The risk comes from what you do next: entering details on a fake site, downloading an app or file, or logging in with a password. Read the address your camera previews, and close the page if anything looks wrong rather than entering information.

How can I tell if a QR code is fake?

Check whether it's a sticker over something else, read the full web address your phone shows before opening, and ask whether a code makes sense in that place. If you're paying for parking or logging into an account, use the official app or type the website address yourself instead of scanning.

Is it safe to pay for parking with a QR code?

Be very cautious. Several UK councils have said their parking machines don't use QR codes at all, and fake stickers have been found on machines across the country. Use the operator's official app, phone line or website, which are usually printed on the machine, or pay with card or cash at the machine.

Is Action Fraud still running?

No. Action Fraud was replaced by Report Fraud on 4 December 2025, run by the City of London Police. You can report at reportfraud.police.uk or on 0300 123 2040, the same number as before, and old Action Fraud links redirect there. In Scotland, check the Report Fraud site or contact Police Scotland on 101.

What should I do if I entered my card details after scanning a code?

Call your bank immediately using the number on the back of your card, not a number from the website or message. Explain what happened so they can block the card and watch for fraud. Then report it to Report Fraud, or to Police Scotland if you're in Scotland, and keep any screenshots.