Drivers urged not to use QR codes when paying in car parks as ‘quishing’ becomes a growing threat

Motorists are being warned not to pay for public parking using QR codes due to the growing threat of scammers stealing private information and money.

‘Quishing’ is the growing criminal activity of placing fake QR codes on payment machines in car parks to defraud unsuspecting drivers by tricking them into entering credit and debit card information on fake websites.

The RAC said the scam often has a double whammy for victims, who not only hand over their payment details to the thieves but also receive fines from councils and private companies for failing to pay the parking fee.

Experts have pointed out that the shift to cashless payment systems by councils and car park operators is accelerating the problem.

The car group has urged drivers to be “very vigilant” in car parks and to pay for parking only with cash, cards or official apps linked to operators.

The warning comes after a surge in illegal activity in municipal car parks.

Over the past month, there has been a huge increase in fake QR codes on parking machines in Barking and Dagenham, Northumberland, Northamptonshire, South Tyneside and Pembrokeshire, which appear to use the PayByPhone app to collect parking payments.

The RAC is also aware that a car park in Lytham St Annes, which uses the MI Permit app for payment, was attacked.

Fake codes lead people to enter their card details into fraudulent websites set up to steal payment information, which criminals then use to spend money from their bank accounts.

Simon Williams, RAC policy officer, said: “A car park is one of the last places you would expect to fall victim to online fraud. Unfortunately, the increasing popularity and ease of use of QR codes appears to have made drivers more vulnerable to malicious scammers.

‘For some, this unfortunately means that a quick response code could, in fact, be a ‘fast track’ to losing money.’

Drivers who have been victims of this crime have also been sanctioned for not paying the corresponding fee for parking in public spaces.

“As if this parking scam wasn’t nasty enough, it can also lead to drivers being caught twice if they don’t realise they haven’t paid for parking and end up with a hefty fine from the council,” Williams continued, adding that “the safest course of action is to avoid using QR codes altogether.”

He added: ‘Most councils don’t even operate a QR code payment system, so if you’re in any doubt, steer clear and only pay with cash, card or via an official app downloaded from your smartphone’s app store.

‘This advice should also apply to any mode of transport where payment can be made using a QR code, including electric vehicle charging points and private car parks.’

The RAC says the rise in such offences is further evidence of the “critical need” for a National Parking Platform, which would allow motorists to use a single app to pay for parking.

‘With people faced with a plethora of different payment apps depending on where they are in the country, it’s no surprise that many are turning to the convenience of using QR codes they see on payment machines.’

Four tips for paying safely with a QR code

1. Check if it has been pasted onto the parking payment machine. Telltale signs are if the code appears too large or partially obscures official information underneath.

2. Make sure the payment website URL is secure and is the official site of the company you want to pay. Look for a padlock symbol and an address that begins with https://

3. If you are concerned that you may have used a fake code, check your bank statement and banking app for suspicious transactions.

4. If someone calls you claiming to work for your bank, ask them for a reference number and then call your bank’s actual number listed on a letter they sent you or on their official website. Never call the number a caller gives you over the phone or in an email.

Source: RAC

Experts warn that councils and car park operators are removing payment machines that accept cash, accelerating the risk of scams such as quishing.

The shift to cashless payment systems accelerates the threat of fraud

Experts have said the shift to cashless parking payments is accelerating the risk of falling victim to scammers.

Parking payment machines could be virtually extinct within a decade, the head of a parking app suggested last year.

Anthony Eskinazi, chief executive of JustPark, said he “doesn’t see” any local authority buying traditional meters “beyond 2025”.

And since procurement contracts typically last up to eight years or less, this means motorists may struggle to find parking meters beyond 2032.

This comes after the Daily Mail revealed how more than two million people could soon be living in “parking meter deserts” as local authorities increasingly ditch the machines in favour of cashless alternatives such as mobile apps.

The move is partly due to a 2033 deadline for telecoms companies to switch off their 3G networks; Vodafone plans to begin phasing out the technology from June.

The RAC says its own research shows drivers would prefer to pay for parking in cash.

However, this is no longer an option for some drivers whose payment machines no longer accept coins or bills.

“We believe there should always be at least two different means of paying for parking in case the technology fails or the parking lot is located somewhere with intermittent cell phone signal,” Williams said.

Here’s what a cybersecurity expert suggests to drivers to stay safe when paying for parking

I’m a cybersecurity expert: here’s how to beat parking scammers

Adrianus Warmenhoven, cybersecurity expert at NordVPN, the virtual private network service provider, added: ‘Our research shows that three-quarters of Brits do not check QR codes before scanning them, and only one in six drivers are aware that QR code scams are possible.

‘In our increasingly digital landscape, even something as simple as parking a car can require the use of a smartphone to pay.

Scanning a QR code is much easier than typing in website names, and we found that nearly a quarter of people have scanned QR codes on stickers in public places like parking lots.

‘It’s good news to see the RAC raising awareness of the problem, but we need parking companies to take decisive action to control and stamp out these scams.

‘Before scanning a QR code in a car park, make sure it comes from a trusted source and check with the establishment that it belongs to them. Look for a padlock symbol in the URL box of your smartphone’s web browser which will indicate that the system is using a secure server.

‘For added security, ditch the camera app and consider using a dedicated QR code scanning app, as these can often detect malicious sites or software.

‘If a QR code redirects you to an unrelated or suspicious website, refrain from providing any personal information and leave the page immediately. You can also try calling the parking company to double-check if you’re unsure.

‘Paying by credit card is another sensible precaution, as credit card companies are obliged to refund your money unless they can prove you are trying to defraud them.’

Have you been a victim of a QR code scam? editor@thisismoney.co.uk