‘Pay here': the QR code ‘quishing' scam targeting drivers

You park the car and look for somewhere to pay. A large QR code on the machine offers to take you directly to the right website where you put in your card details before going on with your day. Only much later are you hit with the double whammy: money gone from your account, and a fine for not paying the genuine parking company.
The rise in app- and phone-based parking payment has opened a new frontier for fraudsters: quishing – so called because they are phishing attacks that start with a QR code. The fraudsters stick the codes in places where you would expect to see details of how to pay to park. When you scan one, it takes you to a site where you are asked for your payment details – as you would expect when booking parking.
One victim who scanned a code in a station car park told the BBC that the fraudsters tried to take payments then posed as her bank to get more information from her, before running up £13,000 worth of debt in her name.
Last year, the UK's Action Fraud received 1,386 reports of scams involving QR codes – a small number, but more than double that in the previous year. In just the first three months of 2025 there were 502, suggesting the problem is growing.
Chris Ainsley, the head of fraud risk management at Santander UK, says it is hard to get a full picture of the scale of the fraud. 'Unless drivers receive a parking ticket, a lot of people are unaware that their personal or card details were compromised in this way,' he says. 'When it comes to reporting the eventual scam, often the fact that it originated through quishing goes undocumented.'
A QR code where you might expect to see one – on a parking charge machine, on a post in a car park or sometimes on a public EV charger.
The code will be on a sticker.
The website will ask for your payment details. It will also ask for your car details, but that is likely to be just an attempt to convince you it is a legitimate parking website.
You may later get a call from someone pretending to be from your bank who will use the information you have given and tell you that you have been defrauded and need to move your money to a safe account. The safe account is actually in the control of the scammers. Do not do as they ask – your real bank would never request this.
Be suspicious of any QR code on a parking payment machine or signpost in a car park. Check that it has not been stuck over a legitimate code.
If you have the right parking app already on your phone, use that rather than scanning a code.
Use cash or a card to pay at a machine if those are an option.
Check the URL of the website before you click on it – it should appear on your phone as you scan the code. Do not click on it if it looks suspicious.
When you land on a page through a QR code, check details to make sure it is not a fraudulent version. Giveaways include weird URLs and bad spelling. Check that the URL includes HTTPS, rather than HTTP, before handing over details.
Keep an eye on your bank account and report any suspicious payments to your bank.
Report the scam to the local council, police and car park owner if it is a private company.

Try Our AI Features

Explore what Daily8 AI can do for you:

Learn with AIFact CheckingText to SpeechAI Summary

Related Articles

The Independent

30 minutes ago

• The Independent

Sunken British super yacht raised from seabed off coast of Sicily

A British owned Bayesian superyacht that sank off the coast of Sicily in August has been raised from the seabed by a specialist salvage team. Seven out of 22 people on board died during the sinking, including its owner, British tech tycoon Mike Lynch and his 18-year-old daughter. Freak weather caused the vessel to sink in August however naval experts claim the Bayesian should have been able to withstand and should not have sunk as rapidly. A diver from the specialist salvage company died in May during a preliminary recovery operation according to Italian media.

Daily Mail​

30 minutes ago

• Daily Mail​

'You money grabbing little dog' - 'Jealous' drug dealer's messages to his ex-girlfriend are heard in court as he is accused of brutal murder of 'love rival' who was 'tortured to death' in his own home

A 'jealous' drug dealer accused of masterminding the brutal torture and killing of his alleged love rival branded his ex-girlfriend a 'money-grabbing little dog', a court heard today. John Belfield, 31, allegedly plotted the murder of Thomas Campbell out of 'hostility' because the victim had begun dating his ex-partner, as well as to steal from him. The 38-year-old's bloodied body was found bound in extra-strength duct tape and dressed in only a pair of socks in his own home in July 2022. In the run-up to the killing, Belfield was given crucial details about the intended victim's movements by Campbell's ex-wife Coleen, a jury has heard. She was later found guilty of manslaughter and conspiracy to rob. Today Manchester Crown Court heard of threatening messages that Belfield sent to his ex-girlfriend Demi-Lee Driver, who had begun a relationship with Campbell. In one he wrote: 'You and that helmet will get domed. 'Shut your mouth you dog.' Another read: 'There's not a thing you or him will do so. I think you should get my draws out your house Monday.' Belfield added: 'And I'm going to shag his baby mum now for the point of it, you money grabbing little dog.' Ms Driver refused to give police access to her mobile phone but shared screenshots of the Instagram messages, jurors were told. Giving evidence in his defence today, Belfield admitted being a drug dealer but claimed he had been at his sister's home on the night of the killing. His barrister Richard Wright KC asked him: 'Do you understand that the prosecution allege that, together with his ex-wife Coleen Campbell, you had personal motivation to attack Thomas Campbell because he was in a relationship with your ex partner Demi-Lee Driver? 'You were annoyed or jealous of that relationship?' Belfield replied: 'I understand that.' Mr Wright asked: 'Did you conspire with Coleen Campbell and others to target Mr Campbell as a victim for robbery in his own home?' The 38-year-old, pictured with Coleen on holiday, was discovered by shocked neighbours 'No,' Belfield replied. Mr Wright asked: 'Were you motivated by jealousy or anger to attack Mr Campbell because he was in a relationship with Demi-Lee Driver?' Belfield anwered: 'No.' Belfield admitted that he had planned to to target Mr Campbell at some point in order to steal his drugs and admitted that he himself was a drug dealer. He denied being part of the team which placed a tracking device on Mr Campbell's VW van five days before the murder and said he did not know it had been put there. Belfield admitted he had taken part in alleged 'recces' of Mr Campbell's home in Mossley, Greater Manchester. But he denied that he had been one of the men who bought items used in the torture of Mr Campbell from a B&Q store in Oldham four days before the killing. Mr Wright asked him if he was with Reece Steven - who has been convicted of Mr Campbell's murder - when he was attacked and killed. He replied: 'No. I was at my sister's house with my niece and nephew.' Belfield admitted that he had taken part in efforts to disguise the van used in the attack but said he had done so 'to help my friends'. He also agreed that he had fled the country after the murder, travelling to the former Dutch colony of Suriname in South America. But he said: 'I was scared his friend were going to attack me and kill me because of the rumours they had heard.' The court has heard the 'horrific' killing was the result of 'very careful planning by a team of highly organised criminals' who used a tracking device placed on Mr Campbell's car and carried out reconnaissance on his home in the days before the assault. Jurors have been told that at a 2023 trial Reece Steven was convicted of murder and conspiracy to rob. Stephen Cleworth, from Heywood, who acted as a driver, was convicted of manslaughter and conspiracy to rob. He was responsible for planting the tracker on Mr Campbell's vehicle and assisting with surveillance although he was not present during the murder. Belfield - alleged to have been the 'driving force' behind the killing - is now standing trial for the murder after being extradited back from South America. The prosecution case is that Steven, Belfield and a third unknown man were all present when Mr Campbell was tortured to death. Belfield, of no fixed address, denies murder and conspiracy to rob. The trial continues.

Daily Mail​

43 minutes ago

• Daily Mail​

Girl, three, has arm ripped open by cockapoo as her father is forced to 'hold her skin together' after attack outside primary school

A girl, three, has had her arm ripped open by a cockapoo, with her father forced to 'hold her skin together' after the attack outside a primary school. Bunnie was walking home with her father Rowen Skinley and two siblings in Rainham, Kent, on Tuesday when the designer dog attacked outside Miers Court Primary School. She had to be rushed to hospital in London for emergency plastic surgery after the Cocker Spaniel and Poodle crossbreed brutally mauled her unprovoked. The owner of the small, sandy-coloured pooch 'just disappeared', leaving no details, after pulling the dog off the toddler and tearing her skin in doing so, Mr Skinley said. The father explained: 'I was so shocked. All I had to stop the bleeding was my hands. I had to basically hold her skin together.' Thankfully, he continued: 'She's doing well now. She's just a bit shaken and keeps talking about how scared she is of the dog... 'It's really upsetting that the woman didn't stop because it makes you fear for the safety of other kids.' A Kent Police spokesperson confirmed an investigation is ongoing. Cockapoos have often been touted as family-friendly bundles of cuteness - playful, warm, curly-haired teddy bears, who are easy to manage and train. But Mr Skinley had a rather different experience with the popular breed: 'It happened parallel to the school on the main road. I was just walking home after the school run. 'The path is quite narrow and a woman was walking her dog on the actual road itself. 'Then, out of nowhere, the dog just lunged for my daughter and pulled her to the floor.' Bystanders rushed over to help: 'People who saw what happened came over and said that my daughter hadn't even put her hand out to the dog.' Bunnie was taken to Medway Maritime Hospital in nearby Gillingham before being transferred to St Thomas' Hospital in Westminster, London, the next morning. There, she had several X-rays to ensure the puncture had not hit her bone, before undergoing the reconstructive surgery. Mr Skinley explained: 'She also has a lung condition and really bad asthma so she had to be marked down as a high-risk category for sedation.' The girl will have to return to hospital within a week for a check-up, to assess if she needs even more surgery. Anyone with information that could assist officers' inquiries, including CCTV or doorbell footage, should contact police on 01634 792209, quoting 46/102876/25. It comes after MailOnline revealed at the end of last year that at least 16 dangerous dogs are seized every day in the UK. Just under 6,000 dangerous dogs were seized by 27 forces from November 2023 until the same month the following year, a Freedom of Information (FOI) request found - meaning 114 dogs are taken every week. Of the forces which responded to the FOI, Greater Manchester had the highest figures, with 19 dogs seized a week. It took 1,000 in a year and put 337 of the animals to sleep. Second highest is the West Midlands force with 17 dogs, followed by Northumbria with nine. West Yorkshire seized eight a week, while Leicestershire said it seized six. Experts have now warned that banning dangerous dogs in order to keep the public safe has 'critical flaws' and the focus should be on making owners more responsible instead. A spokesperson at which obtained the data, said: 'The Dangerous Dogs Act has been in effect for over three decades and yet, hospital admissions due to dog bites continue to rise.' They added that instead of focusing on breed, the emphasis should be on 'addressing the root causes of dog aggression' instead.