When Les Howard could not find change for a parking meter on a trip to the coast, the QR code stuck on the machine seemed to solve the problem. A quick scan, an app, a card payment, done. The next day he found out the code had been put there by criminals, and they were taking money from his bank account in £60 chunks.
Howard, 61, from Widnes, was visiting Caernarfon in North Wales with his wife. "I normally have change in the car to pay for the parking, but this time I didn't," he told <a href="https://www.bbc.co.uk/news/articles/cwyjqg578e1o">the BBC's Scam Secrets podcast</a>. "So there was a QR code to download and get an app and pay via an app."
He had second thoughts almost immediately. "I thought 'I don't like the idea of this because I'm going to have to put my card details into an app that I've only just downloaded, which wasn't of my choosing'." He deleted the app and moved the car. A notification arrived anyway: £1 had gone to the same recipient. The next day, £60. His bank told him the scammers had set up a monthly £60 subscription. "It's a good job you rang up," the woman on the phone said.
The council that runs the car parks, Cyngor Gwynedd, says it does not use QR codes for parking payments and has removed two fake stickers from its car parks in the past year. The same trick has appeared in car parks and railway stations across the country.
This kind of fraud, known as "quishing", is growing fast. Report Fraud, which covers England, Wales and Northern Ireland, told the BBC it received 2,743 reports mentioning QR codes in the past 12 months, against 341 in the year ending August 2022. Data from City of London Police, released under the Freedom of Information Act, points the same way, and the true figure is probably higher: many victims never report it.
"We're definitely seeing a rise in the use of QR codes to conduct a range of criminal activity," said Ollie Whitehouse, chief technology officer at the National Cyber Security Centre. "I think as they become more commonplace, naturally criminals will jump on to the back of that."
The codes are everywhere these days, and fraudsters follow the crowd. Criminals hide suspicious links in emails, hijack messaging apps, or, as in Howard's case, persuade people in the street to download an app that turns out to be a payment trap.
The NCSC's advice is simple: use the QR scanner built into your phone, usually the camera, rather than downloading a separate app, since some apps carry adverts that make it hard to tell which link is which. And if an app asks for card details the moment you scan a code, that alone is a reason to stop.