Fighting back against the ‘Quishing’ threat: How councils and private car park operators can quickly shut down car park QR code scams
Car parks have become prime real estate for “Quishing” using QR code scams. A recent investigation by the Bureau of Investigative Journalism (TBIJ) reveals that nearly a third of all UK councils and over a dozen hospitals, have been targeted by this rapidly growing digital fraud.
“Quishing” involves criminals plastering fake QR code stickers directly onto payment machines or street signage. When unsuspecting motorists scan them, they are directed to slick, lookalike payment sites designed to steal card details. Beyond the initial theft, many victims find themselves trapped in recurring, bogus subscription fees.
Criminal gangs are putting fraudulent QR code payment stickers on car park signs
A Global Problem on Local Streets
While still emerging, the scale of the financial impact is stark. Action Fraud tracked nearly 800 reports of QR fraud over a 12-month period, with losses topping £3.5 million.
The issue has caught the attention of Westminster. Joe Powell, MP for Kensington & Bayswater, warned that global fraud networks are actively exploiting UK regulatory loopholes to run these operations. Powell noted that while fraud now makes up 40% of all UK crime, it receives just 1% of policing resources — leaving local authorities heavily reliant on their own defences to protect the public.
The Frontline Reality for Parking Teams
The TBIJ’s Freedom of Information requests expose just how widespread the issue is for local authorities:
-
123 out of 373 responding councils confirmed their car parks were targeted over the past year.
-
A large city council reported a total saturation, with scammers targeting every single one of its 370 ticket machines.
-
Over 20 NHS hospitals across the country were also compromised.
However, the true figure is likely much higher. Because parking wardens and maintenance staff frequently rip down the fake stickers on the spot without formally logging the incident, the full scale of the breach often goes unrecorded. For parking managers, tighter reporting protocols and regular machine audits are fast becoming operational necessities.
Car park managers and operators are combating the criminals that are placing stickers directly on to car park ticket payment machines, sometimes trying to block card readers
A quick and easy digital solution to gain control and fight QR code scams
So what can be done by councils and even private operators to minimise and in some cases eradicate the problem? Unity5’s Zatpark enforcement software is now used by 1 in 3 councils across the UK. Here are some simple steps that have been proven to help in the fight against car park QR code scams:
- Council Officers can set up a custom task in the Zatpark back office and set it for the Zatmobile+ app
- They can set a custom name for the task such as “Check signage/machines for QR stickers”
- They can then assign tasks of this type to their team of CEOs.
- These tasks are sent though to the mobile apps that the CEOs carry – instantly without needing to sync
- All users can see and complete them straight away
Zatpark software back office allows a new automatic daily reminder task to be set up for the mobile app used by CEOs on the street
Chat with our friendly experts now and level up your fight against QR Code based fraud
Already with us? We’re pleased to offer advice on how best to use Unity5 solutions to combat fraud, so please contact your Account Manager today.
New to Unity5? Click here to book a no obligation discovery call with our friendly team
Marketing Manager
