Les used a QR code to download a parking app - but it was a scam

Imagine popping to the shops, spotting a QR code stuck to a parking meter, scanning it, downloading what looks like a legitimate parking app, and paying for your ticket. Simple, modern, convenient. Except weeks later you notice £60 disappearing from your account every month, for a subscription you never knowingly signed up to and a service you never use again.

That is exactly what happened to Les, whose story was reported by BBC News this week. It is a warning that deserves far more attention than a single headline, because the scam he fell victim to is spreading quietly across UK car parks, and the way our parking system now works has made drivers more exposed to it than ever before.

What happened

According to the BBC report, Les scanned a QR code, believing it would take him to a genuine parking app so he could pay for his stay. Instead, the code led to a fraudulent app that took his payment details and, crucially, set up a recurring £60 monthly subscription. He had no idea the payment was being taken until it had already happened, and getting it stopped required contacting his bank rather than the fake operator.

The BBC's report is part of a growing pattern of warnings about "QR code parking scams", sometimes called "quishing" (phishing via QR code). Fraudsters print their own QR codes, often near identical in style to the genuine council or private operator sticker, and place them directly over or next to the real one on a meter, sign, or bay marker. A driver in a hurry has no easy way of telling the two apart. There is no padlock icon to check, no obviously suspicious web address, just a small black and white square that could lead absolutely anywhere.

Why it matters

This story lands at a particularly sensitive moment for UK parking. Councils and private operators have spent the past few years pushing hard towards cashless, app-based payment. Coin-operated meters are disappearing, ticket machines are being decommissioned in some areas, and drivers are increasingly expected to download an app, scan a code, or text a payment reference just to park legally. We have already looked at how broken meters and app problems can leave drivers facing unfair PCNs, but Les's case shows the risk runs deeper than a glitchy payment screen. It shows that the infrastructure itself, the physical QR code stuck to a post, can be hijacked.

The wider implication is that the shift to app-only parking has created a genuinely useful new attack surface for criminals. A fake QR code costs almost nothing to produce and print. It can be slapped over a real one in seconds, works on any car park in the country, and by the time a driver realises something is wrong, the fraudster may have already collected weeks or months of subscription payments from dozens of victims. Councils, the British Parking Association, and police forces have issued periodic warnings about this exact tactic, urging drivers to be cautious rather than assuming every code they see in a car park is genuine.

There is also a knock-on parking consequence that is easy to overlook. If a driver scans a fake code and pays a scam app instead of the real one, they have not actually paid for parking at all. In the eyes of the council or private landowner, the bay is unpaid, and a Penalty Charge Notice or private parking charge can still land on the windscreen or through the post, layering a genuine parking dispute on top of the financial fraud. Being a victim of a scam does not automatically excuse you from a parking charge, although it may be relevant evidence if you challenge one.

The legal angle

There are several separate legal threads running through a case like this, and it is worth understanding how they interact.

The fraud itself falls under the Fraud Act 2006, specifically fraud by false representation, since the scammer is presenting a fake app as a genuine parking payment service to obtain money. This is a criminal matter, and incidents like this should be reported to Action Fraud (or Police Scotland directly, if you're in Scotland), even though the practical chances of recovering money from an anonymous fraudster are often slim.

Stopping the money leaking away is where drivers have more concrete rights. A recurring card payment set up this way is typically a continuous payment authority (CPA). Under Financial Conduct Authority rules, you have the right to cancel a CPA directly with your bank or card provider at any time, and the bank must act on that instruction, it cannot insist you go back to the merchant first. This is separate from, and generally simpler than, cancelling a Direct Debit, and it is the first call anyone in Les's position should make.

Getting money back may be possible through your card issuer. Debit card payments can sometimes be recovered via the chargeback scheme run by Visa, Mastercard or American Express, while credit card payments over £100 may attract additional protection under Section 75 of the Consumer Credit Act 1974, which makes the card provider jointly liable for certain breaches connected to a purchase. Banks are not always fast or sympathetic with fraud claims, and outcomes vary, so it is worth being persistent and putting complaints in writing if a first call does not resolve things.

The genuine parking charge, if one arrives because the real payment was never made, is a separate matter entirely and would need to be dealt with through the normal challenge or appeal route for that particular ticket, whether that is a council PCN or a private parking charge notice.

What drivers should know

A few practical habits can make a real difference here.

• Be suspicious of QR codes that look stuck on, damaged, or slightly askew, especially if they are layered over what looks like an older, more official sticker underneath.
• Check the app name and publisher before entering any payment details. Genuine council and private parking apps are run by a small number of well known providers such as RingGo, PayByPhone, JustPark, and MiPermit. If a QR code takes you to an app you have never heard of, search for it independently rather than trusting the download link in the code.
• Look at the signage around the bay. Councils and operators are legally required to display clear terms for parking, including the accepted payment methods. If the QR code contradicts or has nothing to do with the signage, treat it as a red flag.
• Use the official council or operator website instead of scanning. Most local authorities list their approved parking app on their own website, so typing the council's name into a search engine and finding the app that way is safer than trusting a sticker.
• Check your bank statements regularly, particularly after using an unfamiliar app for the first time, so a rogue subscription is caught after one payment rather than several.
• If you spot a suspicious QR code, report it to the council or car park operator so it can be removed before it catches anyone else, and consider reporting the app itself to Action Fraud.

If you are unsure whether an app you have already used is genuine, it is worth checking reviews, the developer's details in the app store, and whether it has a proper company registration, before deciding whether to continue using it or contact your bank.

Looking ahead

Cases like this are likely to keep appearing as long as councils and private operators continue moving towards app-only and QR-code payment systems without doing more to help drivers verify what they are downloading. There has been talk of a unified national parking payment system, which could, in theory, reduce this kind of confusion by giving drivers a single trusted app to use everywhere rather than dozens of different providers with dozens of different QR codes to memorise. We have covered the debate around a national parking platform that could bring payment under one roof, and stories like Les's add real weight to the argument that standardisation would help drivers as much as convenience does.

Until that happens, the burden largely sits with individual drivers to stay sceptical of stickers in car parks, however official they look. A moment's hesitation before scanning could save you from months of unwanted subscription payments, and a good deal of hassle trying to get your money back afterwards.

If you are dealing with a genuine PCN as a result of a payment issue, whether from a scam app, a broken machine, or a payment that simply failed to register, it is worth reading up on your options for challenging PCNs linked to app and payment errors before assuming the charge has to be paid.