QR Code Scams Surge: Organised Crime Gangs Behind 'Quishing' Wave Across UK

A growing wave of scams involving fraudulent QR codes—known as “quishing”—has been traced back to organised crime groups, raising serious concerns among cybersecurity experts and public safety officials.

Councils warn of fake QR code scams in car parks.

According to data from Action Fraud, the UK's national fraud reporting centre, reports of such scams skyrocketed to 1,386 in 2024—up from just 100 cases in 2019. Experts warn that the real figure could be significantly higher due to underreporting.

The New Face of Digital Deception

These scams typically involve criminals placing counterfeit QR codes on everyday items such as parking meters, restaurant menus, parcel labels, and even television screens. Unsuspecting users, often in a rush or unaware of the risk, scan these codes and are redirected to fake websites designed to harvest sensitive personal information, including banking credentials.

Katherine Hart, a senior officer at the Chartered Trading Standards Institute, explained that losses from these scams have been devastating: “People are losing their life savings to what might appear to be a harmless scan. This isn’t petty crime—it’s feeding organised criminal operations.”

A Victim Speaks Out

Among the victims is 63-year-old Milton Haworth, who scanned a QR code at a council-operated parking lot in Castleford, West Yorkshire. Expecting to pay a nominal parking fee, he unknowingly subscribed to a fraudulent service that billed him £39 annually—with no option for a refund.

“I didn’t think something so common could be fake,” Haworth said. “The council signage looked official. It wasn’t until I saw the charge on my bank statement that I realised I’d been scammed.”

Since the incident, Haworth has refused to scan any QR code, calling on authorities to act with urgency. “If each victim loses just £39, and a million people fall for it, that’s a massive profit for these criminals.”

Hidden Hierarchies and Bigger Threats

Investigators believe many of the individuals placing the fake QR codes may be low-level operatives within larger criminal networks—and might not even understand the full scope of the fraud they're helping to commit.

The BBC’s Shared Data Unit reports that nearly 3,000 such scams have been recorded over the past five years, with nearly 20% of the reports coming from the Greater London area.

But it’s not just small change at risk. Hart warns that the initial scam is often just the first step. “They might lure you in with a £2.99 charge, gather your data, and later launch a more elaborate scam impersonating your bank or even the police.”

Call for Vigilance

The National Crime Agency and National Cyber Security Centre urge the public to be alert when scanning QR codes, especially in public spaces or on unsolicited messages. Officials recommend verifying URLs before submitting any personal details and avoiding QR codes that prompt app downloads or financial transactions unless from verified sources.

As the digital world becomes increasingly integrated into everyday life, so too does the potential for exploitation. Staying aware and cautious may be the most effective defense for now.