Action Fraud is urging people to look out for rogue QR codes, after 784 reports of ‘quishing’ were made to Action Fraud between April 2024 and April 2025, with almost £3.5 million lost.
Quishing is a form of phishing where a fraudulent QR code is scanned, designed to steal personal and financial information. The warning encourages people to stay vigilant, and double check QR codes to see if they are malicious, or have been tampered with, before scanning them online or in public spaces.
Claire Webb, acting director of Action Fraud, said: “QR codes are becoming increasingly common in everyday life, whether it’s scanning one to pay for parking, or receiving an email asking to verify an online account.
“However, reporting shows cyber criminals are increasingly using quishing as a way to trick the public out of their personal and financial information.
“We’re urging people to stop and check before scanning QR codes, to avoid becoming a victim of quishing.
“Look out for QR codes that may have been tampered with in open spaces, or emails and texts that might include rogue codes.
“If you’re in doubt, contact the organisation directly. You can follow our advice on quishing, on our website at www.actionfraud.police.uk to help protect yourself.”
Action Fraud revealed that quishing happens most frequently in car parks, with criminals using stickers to tamper with QR codes on parking machines.
Quishing also occurred on online shopping platforms, where sellers received a QR code via email to either verify accounts or to receive payment for sold items.
Reports also showed phishing attacks were taking place impersonating HMRC, or other UK government schemes, targeting people with QR codes designed to steal personal and financial details.
Find out how to protect yourself from fraud at https://stopthinkfraud.campaign.gov.uk.
If you’ve been a victim of fraud, report it at www.actionfraud.police.uk or by calling 0300 123 2040.
