You might want to think twice before you scan the menu at your next pasta date or cocktail night. QR code scams, also known as ‘quishing’, are on the rise and have seen victims lose their entire life savings. Worse still, they can be far more obscure to both identify and stop.
According to national fraud reporting centre, Action Fraud, there were 1,386 reports from people targeted by the scam in 2024, compared to just 100 in 2019. Experts have pointed to organised criminal gangs as the culprits and reveal that common targets for the scam include restaurant menus and parking metres, as these can be difficult to distinguish from the real thing.
Katherine Hart, lead officer at the Chartered Trading Standards Institute, told the BBC: “We’ve seen huge amounts lost this way. People have seen their life savings gone and that money is going to finance criminals.” She explained that the stickers were likely being pasted by those near the bottom of a criminal gang hierarchy who may not be fully aware of the implications of their actions.
The way the ‘quishing’ typically works is that the unsuspecting scanner will be directed to websites controlled by nefarious third parties. From there, they will be tricked into handing over their bank details or other personal information.
Often, the amounts asked to be sent over will be small, so as not to arouse suspicion. Milton Haworth revealed to the BBC that he fell victim to the scam when scanning a QR code at a parking metre. Initially, he said he was only asked to send over 90p to confirm his card details.
However, this quickly escalated, when he was duped into purchasing a £39 yearly subscription with no option for a refund. He complained that the authorities “weren’t taking this seriously enough”, given the relatively small amount of money involved.
Even more troubling, drug dealers have been accused of using the codes to target children. Locals in Watford recently discovered an assortment of cannabis stickers placed at eye level on telephone poles near a junior school, as reported by The Mirror.
Once scanned, the code would take them to a website registered in Belize, promising next-day delivery on cannabis products. Concerningly, some of these substances can even be discounted by as much as 33%.
QR codes have been around since the 90s and were originally used in automobile manufacturing as a way to label car parts. However, their public usage exploded on the back of Covid, making them a ubiquitous feature of everyday life. From plane tickets to digital birthday cards, QR codes are everywhere.
The problem with their proliferation is only heightened by the fact that quite literally anyone can make one. All you need to do is enter a link into a QR code generator, many of which can be found and used for free online. Then, voila, you have a shiny new code that is completely indistinguishable from one created by a reputable business.
According to the UK’s National Cyber Security, the majority of QR code-related fraud tends to happen in open spaces, such as train stations or car parks. It often also involves a level of social engineering, such as criminals posing as staff members or calling victims once they have given their details. You can avoid QR code scams by checking for the following:
The site also advises to watch out for the scam when using email. Most of us are able to spot a dodgy link or phishing attempt when they pop up in our inbox, but QR codes can be far more difficult to detect since you can’t actually read the link.
At Reach and across our entities we and our partners use information collected through cookies and other identifiers from your device to improve experience on our site, analyse how it is used and to show personalised advertising. You can opt out of the sale or sharing of your data, at any time clicking the “Do Not Sell or Share my Data” button at the bottom of the webpage. Please note that your preferences are browser specific. Use of our website and any of our services represents your acceptance of the use of cookies and consent to the practices described in our Privacy Notice and Cookie Notice.