Les used a QR code to download a parking app - but it was a scam

- Published

When Les Howard could not find change for parking during a trip to the coast, a quick response (QR) code on the meter seemed to be the answer.

But the next day, the 61-year-old realised he had become the victim of an increasingly common scam as criminals started taking money from his bank account in £60 chunks.

Reports of QR code-related scams have gone up by 700% in the past four years, figures by Report Fraud have revealed.

Experts say criminals are finding different ways to exploit the codes as they become a common part of everyday life.

This could be disguising suspicious links in emails, gaining access to victims' messaging apps or convincing people who are out and about to download fraudulent apps to steal their money and data.

That is what happened to Howard, from Widnes, who was visiting Caernarfon in North Wales with his wife.

"We went to the car park where we normally go," Howard told the BBC Scam Secrets podcast.

"I normally have change in the car to pay for the parking, but this time I didn't.

"So there was a QR code to download and get an app and pay via an app."

Other people in the car park were doing the same thing but Howard recalled how he became suspicious.

"I thought 'I don't like the idea of this because I'm going to have to put my card details into an app that I've only just downloaded, which wasn't of my choosing'."

So he stopped, deleted the app from his phone and parked somewhere else.

But by then he said he received a notification on his phone that £1 had been taken from his account.

The next day, another notification came through, but this time for £60, to the same recipient so he called his bank.

"I told them I'd downloaded it, I tried to stop, but I'd obviously gone too far," he said.

"She said 'it's a good job you rang up, because they've set up a monthly £60 subscription'."

The council responsible for car parks in the area, Cyngor Gwynedd, said it did not use QR codes for parking payments, and had removed two fake QR code stickers from its car parks in the past year.

Criminals have used similar tactics in car parks and railway stations across the country.

Data from City of London Police released under the Freedom of Information Act suggests the problem of QR code-related scams - known as "quishing" - is growing.

Report Fraud, which covers England, Wales and Northern Ireland, told the BBC it received 2,743 reports mentioning QR codes in the past 12 months - in the year ending in August 2022 it was just 341.

This is likely to be an underestimate with many victims not choosing to report.

"We're definitely seeing a rise in the use of QR codes to conduct a range of criminal activity," Ollie Whitehouse, the chief technology officer for the National Cyber Security Centre (NCSC), told Scam Secrets.

"I think as they become more commonplace, naturally criminals will jump on to the back of that."

This includes persuading people to scan QR codes that link a victim's messaging app with a criminal's device, Whitehouse said.

Some people have been scammed even though the QR code they are scanning is genuine.

The National Cyber Security Centre advises people to use the QR scanner that comes with their phone - usually the camera - rather than downloading a separate app.

That is because some apps contain adverts so it can be hard knowing which link to click on.

Keith Betton, from Farnham in Surrey, was trying to buy a book about sports cars he had seen advertised in a magazine.

The 66-year-old scanned a QR code on the advert, using an app he had downloaded.

What he only realised afterwards was that he had been offered two links - one to buy the book, and another to a website where he was asked to enter payment details.

Within seconds, he had been asked to agree a zero pounds transaction on his banking app, which he agreed.

"I don't hear anything more for a while," Betton said.

"And then about a month later, my bank contacted me because there was an amount of £59.99 from a company in Prague trying to take that money off my account."

It turned out this was the second charge of that amount that had been taken from Betton's account.

He eventually managed to get a refund from his bank.

'We learn slowly'

The NCSC said QR codes were also increasingly being used in phishing emails to disguise links to malicious sites.

Microsoft said this was the fastest-growing scam technique aimed at people's emails, with 18.7m cases recorded in March of this year.

This is because QR codes allow scam links to "slip through" on email, while a URL embedded in a message might be filtered out as spam, said Professor Filipo Sharevski of DePaul University in Chicago, who has studied the malicious use of QR codes.

The black and white squares also make it easier for criminals to hide the true website they are taking you to, he said, because even if your phone lets you preview the link before clicking, it is often shortened or disguised.

Another reason QR codes are so valuable to criminals is that people are often naturally trusting of them, Prof Sharevski said.

His team has carried out experiments placing QR codes around his university campus and in workplaces, to study people's willingness to scan them.

"We don't question our boarding pass on our phone, we don't question our concert ticket," he said.

"We learn slowly through scam experiences. Our phone rings⦠we abandon that.

"We get an email, and we abandon thatâ¦but these QR codes, we have no reason to suspect them."

Reporting originally appeared via BBC News. Read the full source for additional context.