QR Code Scams Surge Across Europe: What You Need to Know to Stay Safe

Consumers are facing a growing threat from scammers exploiting QR codes in both public places and digital communications. Authorities across several European countries have issued warnings as incidents multiply, with losses reaching thousands per day and cases reported in places ranging from city car parks to personal emails.

• QR code scams, or “quishing,” are on the rise, targeting car parks, payments, and emails
• Consumers have lost millions, with some victims experiencing identity theft and major financial loss
• Official bodies stress never to use QR codes for payments unless 100% certain of authenticity

QR codes have become an everyday convenience—used for tickets, payments, and accessing services. However, this rapid adoption has made them an attractive option for scammers. Quishing, a blend of "QR" and “phishing," refers to the method scammers use by replacing usual links with squares of code that direct consumers to malicious websites.

These scams often involve transferring money, stealing personal or payment data, or infecting devices with malware. Unlike traditional phishing links, QR codes can be harder for both users and automated systems to detect as dangerous, which increases their effectiveness.

A sharp increase in scam incidents has been reported at car parks throughout the UK and Latvia. Fraudsters have been placing fake QR code stickers on payment machines and signage, tricking motorists into visiting fraudulent websites that mimic legitimate payment portals. In Sunderland, Nottinghamshire, and the Lake District, dozens of fake QR codes have been identified and removed in recent months.

The consequences can be serious: not only do victims lose money when they "pay" for parking, but their banking details can also be stolen, leading to further fraud or identity theft. In one recent case, an individual lost £20 to such a scam; in another, a pensioner suffered extensive identity fraud resulting from a single scan.

Quishing is not limited to physical locations. Fake QR codes are also widely distributed in emails, often disguised as official communications from tax authorities or service providers. Victims may be led to convincing fake websites where they unwittingly hand over sensitive data.

Additionally, experts warn against sharing photos of tickets with QR codes on social media. These codes act as digital keys to events—publicly sharing them can allow others to gain access or resell the tickets, locking out the original owner.

According to cybersecurity reports, losses from quishing scams are mounting. With official figures indicating losses of up to £10,000 per day in the UK alone, authorities believe the true numbers may be even higher, as many victims remain unaware that a QR code was the origin of their fraud until it’s too late.

Authorities and cybersecurity experts recommend several steps:

• Always check the link a QR code leads to before taking action. Devices often preview the URL when scanning.
• Avoid scanning QR codes on payment terminals unless you are certain they are official. Most official parking and service providers do not use QR codes for payments.
• Update devices regularly to minimize risks from malware exploiting old vulnerabilities.
• Never share images of tickets or documents containing QR codes online.
• If you suspect you’ve used a fraudulent QR code, act quickly by notifying your bank and resetting passwords.

Vigilance remains the best defense, as even seasoned users can fall prey to scams that exploit our trust in technology’s convenience.

• QR code scams growing popular in Latvia, LSM.
• Lake District fake QR codes found at car parks, BBC.
• Fake QR Code Scam at city car park payment machines, Sunderland City Council.
• Council warns parking QR code scam circulating in Nottinghamshire, BBC.
• How a new scam is costing consumers £10,000 per day, Yahoo.