QR Code Scams ("Quishing"): How To Scan Safely
What you'll learn: what a "quishing" scam actually is, where fake QR codes are most commonly found, and the simple check that protects you every time.
Software for Seniors
8/8/20262 min read
A New Twist On An Old Trick
QR codes — those little black-and-white squares you scan with your phone's camera — have become part of everyday life: paying for parking, viewing a restaurant menu, or connecting to Wi-Fi. Most of the time, that's perfectly safe. But criminals have noticed how much we now trust them, and they've built a scam around that trust.
It's called "quishing" — QR code phishing — and Action Fraud has reported a sharp rise in cases, with fraudulent codes appearing on parking machines, in emails pretending to be from HMRC or delivery firms, and even on posters in public places.
How The Scam Works
A criminal prints a sticker with their own QR code and places it directly over a genuine one — most commonly on parking payment machines.
You scan it, expecting to pay for parking as usual.
Instead of the real parking website, it opens a very convincing fake page asking for your card details.
The same trick appears in emails and text messages claiming to be from HMRC, a delivery company, or your bank, asking you to scan a code to "verify your details" or "resolve an issue" with a payment.
The Good News: Scanning Itself Isn't The Risk
There's nothing dangerous about the act of scanning a QR code with your phone's camera. The risk is entirely in what happens after — the website it opens, and what you're asked to type in once you're there.
How To Check A QR Code Is Genuine
Look at the code itself before scanning — does it look like a sticker stuck over something else, especially on a parking machine or public sign?
After scanning, check the web address that opens. It should match the organisation you expect — a slightly misspelt or unusual address is a strong warning sign.
Never enter your card details or login on a page that opened from an unexpected QR code in an email or text.
If you're paying for parking, it's just as easy — and safer — to use the official council app or pay by phone using the number printed on the machine, rather than scanning.
Genuine organisations like HMRC will never ask you to scan a QR code to "verify" your bank details.
If You Think You've Already Scanned A Fake Code
If you've entered card details on a page you're now unsure about, contact your bank immediately using the number on the back of your card — not any number or link from the QR code itself. You can also report it to Action Fraud on 0300 123 2040 or at actionfraud.police.uk.
A Small Habit That Makes A Big Difference
QR codes aren't going anywhere, and there's no need to avoid them altogether. The habit worth building is simple: pause for a moment after scanning, glance at where you've actually landed, and only carry on if it looks exactly right. That one small check closes the door on this entire scam.
For more guides to staying safe online, visit softwareforseniors.co.uk.
Need help choosing the right app?
Browse our guides or get in touch — we're here to help.
get in touch
hello@softwareforseniors.co.uk
© 2026. All rights reserved.