Motorists are being alerted to a sophisticated scam known as ‘quishing’ that exploits QR codes on parking meters, potentially leading to financial loss and fines. The fraudulent practice has seen a significant increase, with reported cases rising from 100 in 2019 to 1,386 in 2025. This trend highlights a growing vulnerability as more parking facilities transition to cashless payment methods, often relying on mobile apps and QR code integration.

The ‘quishing’ scam involves criminals placing fake QR codes over legitimate ones on parking machines. When unsuspecting drivers scan these malicious codes using their smartphones, they are directed to fake payment websites designed to steal their financial details. This not only results in the loss of money but also leaves the individual liable for parking fines if the payment isn’t processed through legitimate channels.

Understanding the ‘Quishing’ Threat

Dan Briggs, CEO of Motorfinity, a company offering car discounts for frontline workers, has provided crucial advice for drivers to navigate this evolving threat. He emphasizes that while cashless payments offer convenience, they also present new avenues for fraudsters. The core of the ‘quishing’ scam lies in its deceptive simplicity: a seemingly innocuous QR code leads to a fraudulent portal.

Briggs points out that many parking services in the UK are managed by popular payment applications like PayByPhone and RingGo. Crucially, he states that neither of these major providers utilizes QR codes for payment collection on their signage. PayByPhone, in particular, has adopted a firm stance against QR code scams and has ceased providing them to parking operators in the UK for payment purposes.

Identifying a Fake QR Code

Detecting a fraudulent QR code requires a keen eye for detail. Briggs offers several warning signs:

• Physical Tampering: A primary indicator is a sticker placed directly over an existing QR code. Drivers should inspect the sticker for signs of peeling, raised edges, or air bubbles, which suggest it has been applied fraudulently.
• URL Scrutiny: Before proceeding with any payment, it is vital to examine the web address (URL) presented after scanning the code. Look for misspellings, unusual domain extensions (like.xyz or.top instead of.com or.co.uk), or shortened links that obscure the true destination. Several online tools are available to help verify the legitimacy of a URL.
• Official Channels: Even if a QR code appears legitimate, Briggs advises caution. He recommends bypassing the QR code scan entirely and navigating directly to the official website or app of the parking provider. This ensures that the payment is processed through secure, verified platforms.

Best Practices for Secure Parking Payments

To mitigate the risk of falling victim to ‘quishing’ and other digital payment scams, several preventative measures can be adopted:

Prioritize Cash Payments When Possible

Briggs suggests that paying for parking with cash remains one of the most secure methods, especially in an era where digital fraud is on the rise. However, he acknowledges that this option is becoming increasingly scarce as society moves towards a cashless economy.

Use Official Parking Apps and Websites

For those who must pay digitally, it is essential to use the official applications or websites of the parking service providers. Ensure that the app is downloaded from a trusted source (like the official Apple App Store or Google Play Store) and that the website URL is accurate and secure (look for ‘https’ and a padlock icon in the address bar).

Verify Payment Processors

If a parking service does use QR codes or directs you to a third-party payment processor, take extra steps to verify its legitimacy. Research the payment processor independently and check for reviews or official confirmations from the parking authority.

When in Doubt, Find Another Spot

Briggs offers a pragmatic solution for drivers who remain uncertain about the safety of a payment method: simply find alternative parking. He stresses that the potential cost of a scam or a fine is never worth the risk associated with an insecure payment process.

Reporting Suspicious Activity

If you suspect you have been targeted by or have fallen victim to a ‘quishing’ scam, it is important to report the incident. You can report the crime to your local police force. Additionally, reports can be made to national anti-fraud centers, such as report@phishing.gov.uk, to help authorities track and combat these fraudulent activities.

The increasing prevalence of ‘quishing’ serves as a stark reminder for all drivers to remain vigilant and informed about the methods used by fraudsters. By adopting cautious practices and verifying payment methods, motorists can protect themselves from financial loss and ensure compliance with parking regulations.