QR-code banking scams: how to check before paying

A QR code can hide a destination you would never type willingly. The code itself is not inherently dangerous, but it can send your phone to a fake parking, delivery, banking or login page where criminals collect card details, passwords or security codes.

The code removes the visual clue of the web address

With an ordinary link, you may notice that the domain name is wrong. A QR code hides that destination until the phone scans it, which makes a convincing sign or email image more important than the actual website behind it.

The NCSC says QR-code phishing - sometimes called quishing - is increasingly used in emails and that codes in public spaces can also be abused. The risk rises when the page asks for more information than the situation reasonably needs.

Practical checkpoint for QR-code scams that can lead to banking fraud: establish the starting position before you change anything. Use a parking-machine QR sticker that opens a payment page asking for card details and a banking login as a worked example and write down physical location, web address, merchant name, payment request and any credentials already entered. That turns 'The code removes the visual clue of the web address' into a testable sequence rather than a vague problem.

Parking and payment scenarios deserve a ten-second check

If a sticker on a parking meter tells you to scan and pay £4.20, inspect whether the sticker looks original or has been placed over another label. Where possible, use the official parking app or type the operator’s website yourself.

A small payment can still expose the complete card details. The criminal’s profit may come from later transactions rather than the parking fee.

Run the numbers or sequence on paper before repeating the action. In the example of a parking-machine QR sticker that opens a payment page asking for card details and a banking login, separate the amount, date, channel and decision point, then mark which part is confirmed and which part is still an assumption. For 'Parking and payment scenarios deserve a ten-second check', the useful question is not simply whether something can work, but what result you should see next and how long you are prepared to wait before changing route.

Second check for section 2, 'Parking and payment scenarios deserve a ten-second check': use a parking-machine QR sticker that opens a payment page asking for card details and a banking login and write a one-line expected result beside the actual result. Then verify physical location, web address, merchant name, payment request and any credentials already entered. If the two do not match, pause rather than creating another transaction or application. Close the page, navigate to the operator independently and report exposed card or banking credentials according to what was entered.

An email QR code should be treated like a link

Do not assume that an email is safer because it contains an image instead of a clickable URL. The NCSC specifically warns that QR codes can help phishing messages bypass some link-scanning defences and move the victim onto a personal phone.

If the email claims to be from your bank, tax authority or courier, open the known app or website separately. You do not need the QR code to verify a genuine account alert.

Use a controlled process for 'An email QR code should be treated like a link'. Gather physical location, web address, merchant name, payment request and any credentials already entered, take one deliberate action, and record the result before trying a second route. Do not trust the destination merely because the qr code is printed in a plausible place. If the first route clearly cannot complete the job, close the page, navigate to the operator independently and report exposed card or banking credentials according to what was entered rather than improvising with an unverified workaround.

If you entered credentials, respond according to what you disclosed

If you gave a password, change it and any reused versions. If you supplied banking or card details, contact the bank. If the page persuaded you to install software, run the appropriate security checks on the device.

The NCSC’s phishing guidance separates these responses because the risk depends on the information or access you actually gave away.

Build a failure plan before the deadline matters. For QR-code scams that can lead to banking fraud, decide what you will do if the normal route fails at the worst reasonable moment: a bill is due, a payment is time-critical, a phone is unavailable or verification will not complete. Keep enough time and money outside the process to recover. Under 'If you entered credentials, respond according to what you disclosed', note the exact error or refusal wording because that is usually more useful to support than a general statement that it did not work.

Second check for section 4, 'If you entered credentials, respond according to what you disclosed': use a parking-machine QR sticker that opens a payment page asking for card details and a banking login and write a one-line expected result beside the actual result. Then verify physical location, web address, merchant name, payment request and any credentials already entered. If the two do not match, pause rather than creating another transaction or application. Close the page, navigate to the operator independently and report exposed card or banking credentials according to what was entered.

Do not trust a follow-up caller simply because they know you scanned the code

A criminal who captured your name, phone number and card details can call later pretending to be the bank’s fraud team. The detailed story can feel like proof, when it is actually information taken from the phishing page.

End the call and contact the bank independently. Never move money to a “safe account” as a supposed remedy for the QR incident.

Treat evidence as part of the solution, not paperwork added afterwards. For 'Do not trust a follow-up caller simply because they know you scanned the code', keep physical location, web address, merchant name, payment request and any credentials already entered in one dated folder and write a two-line chronology of each contact. Do not trust the destination merely because the qr code is printed in a plausible place, and use only a channel you reached independently when security or fraud is involved.

A QR code hides the destination until after you scan it

The main risk is not the square image itself but the website or payment journey it opens. NCSC guidance notes increasing use of QR codes in phishing emails and warns that codes in open public spaces can also be replaced or covered by fraudulent stickers. Before entering card or banking details, read the web address and ask whether you expected to reach that organisation from this particular code.

Imagine a parking-machine sticker opens a page asking for a £2.50 fee, then the next screen asks for online-banking credentials or a one-time code. Stop. A small initial amount can be used to make the page feel plausible while the real objective is credential theft. Use the official parking app or type the operator's address yourself rather than continuing from a suspicious QR destination.

If you already entered banking details, contact the bank and secure the account; if you installed software or followed instructions that gave device access, treat the phone as potentially compromised as well. Keep a photo of the QR code location and the website address for reporting, but do not revisit the malicious page simply to gather more evidence.

Finish with a decision rule for QR-code scams that can lead to banking fraud. In the worked example of a parking-machine QR sticker that opens a payment page asking for card details and a banking login, the safer next step is the one that preserves evidence and keeps essential money or account access recoverable. If the provider cannot explain the next step clearly, close the page, navigate to the operator independently and report exposed card or banking credentials according to what was entered and keep the case reference until the outcome is reconciled.

Sources and verification

• NCSC - QR codes: what is the real risk?
• NCSC - Phishing scams: what to do
• FCA - Fraudulent payments
• NCSC - phishing guidance

MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.