WHAT THE GUIDANCE SAYS
Most QR codes are harmless. A few are stickers.
Criminals stick fake codes over real ones on parking machines and hide them in emails, because people trust a square of dots more than a strange link. UK guidance comes down to a few seconds of checking before you tap.
LOOK FOR the sticker
THE SHORT ANSWER
The NCSC says QR fraud is relatively small
next to other cyber fraud, but it is growing in email.
CAR PARKS
Action Fraud says quishing happens most in car parks, with stickers placed over the real code on parking machines. If in doubt, find the official app or website instead.
Check a codePUBS AND CAFÉS
The NCSC says the QR codes used in pubs or restaurants are probably safe to scan. Open spaces like stations and car parks are riskier.
See the numbersTHE HABIT
Use your phone's built-in scanner, not a downloaded app, and read the web address it shows before you open it. Does it match what you expected?
Four quick checksA QUICK CODE CHECK
Pick where the QR code is to see what UK guidance says. The bar shows how much caution the guidance suggests.
Based on NCSC guidance and Action Fraud's 2025 quishing alert. This is general safety information.
TWO NUMBERS WORTH KNOWING
Action Fraud figures for April 2024 to April 2025.
Only reported cases are counted.
784
Quishing reports in a year
Reports of QR code fraud made to Action Fraud between April 2024 and April 2025. Car parks were the most common place, followed by online selling platforms.
REPORTS · ACTION FRAUD
≈ £3.5m
Money lost to those scams
Almost £3.5 million was lost across those reports. Some scams impersonated HMRC or other UK government schemes.
LOSSES · ACTION FRAUD
Several councils, including Southend-on-Sea and Aberdeen, have said they do not use QR codes on their parking machines at all, so a code there is a warning sign in itself.
FOUR QUICK CHECKS
Each takes a few seconds. Together they cover what the NCSC, Action Fraud and Which? advise.
On a machine or sign, check whether the code has been stuck over something. If it has, do not scan it.
Scan with the reader built into your phone's camera rather than a downloaded QR app, which can add risk.
Your phone shows the web address before opening it. If it is not the organisation you expected, stop.
If you have lost money, call your bank on the number on the back of your card, then report it to Action Fraud (Police Scotland on 101).
HOW A QR CODE WORKS
QR stands for quick response. Released in Japan in 1994, it could hold about 7,000 numerals, against roughly 20 characters for a barcode. The square marks in the corners tell the reader where the code is, which is what made fast reading possible.
Codes also carry spare data for error correction, so a smudged or damaged code can still be read. The most common setting can restore about 15% of the data. But the code itself says nothing about who printed it: Which? points out that anyone can create one.
Questions
A form of phishing where a fraudulent QR code is used to send you to a website designed to steal personal or financial information. The name joins QR and phishing.
The NCSC says QR codes used in pubs or restaurants are probably safe to scan. It advises more caution in open spaces like stations and car parks, and with codes in emails.
UK guidance recommends using the scanner built into your phone's camera rather than an app downloaded from an app store.
The NCSC says people have learned to distrust odd links, a code hides the link, some email security tools do not scan images, and people tend to scan with personal phones that may have less protection.
Contact your bank straight away using the number on the back of your card, and report it to Action Fraud. In Scotland, contact Police Scotland on 101.
Sources
ABOUT THIS NAME
doodlescan.com is part of the DoodleSale portfolio. It isn't in an auction right now, but you can ask about leasing it.
