UK council car park QR code scams (2024 to 2026)

Netcraft's on-the-ground survey found malicious codes on seven of Southampton city centre's 24 parking meters, in prime positions including opposite Southampton Central station and near a large grocery store, and only on the newer black meters that carry official PayByPhone branding. Activity concentrated in coastal and tourist locations during the summer holiday period, where drivers are least likely to already have a parking app installed. The same technique appears at councils with no documented connection to each other, so this stage describes a shared method rather than one actor's plan.

Attackers built cloned mobile sites impersonating parking payment brands and registered look-alike domains. Netcraft tracked 32 distinct domains for one group, registered through NameSilo on .info, .click, .live, .online and .site, fronted by Cloudflare, with the QR code pointing at a .click URL that redirected to the live phishing site so that a takedown could be answered by changing a redirect rather than replacing physical stickers. Harvested data was exfiltrated to the operators through Telegram bots configured in an admin panel on the site. In one case, in Leamington Spa, the Bureau of Investigative Journalism and its Dirty Payments partners traced the fraudulent charge to a subscription-billing network centred on Aether Group in Dubai, using shell companies in the UK and Cyprus and processing through Worldline, where internal documents showed compliance concerns being overruled. That trace covers one victim's case, not the UK pattern.

Operatives printed adhesive QR-code stickers encoding the fraudulent site and affixed them to parking machines and signage, in two documented variants. Where the operator's genuine QR code was present, the sticker went directly over it: at Watchet a fraudulent code was "stickered on top of an official PayByPhone code", and in Southampton the codes were "pasted on top of the official branding to improve impersonation", sometimes three stickers to a meter. Where no payment QR code existed, as at Cheltenham and Swindon, whose councils both state they do not use QR codes for parking payment, the sticker had to manufacture the expectation of a payment code rather than replace one.

A driver needing to pay scanned the sticker, trusting it because it sat on legitimate, government-operated infrastructure at the moment payment was needed. In Castleford the driver scanned only after another motorist told him the machine was not accepting coins.

The scan routed the victim to the fraudulent site, which requested a parking location code, vehicle details, parking duration and then full card details including the security code, submitting each form to the server as it was completed so that data was captured even if the victim abandoned the flow. Sites then showed a fake "Processing" screen and a "Payment accepted!" page before redirecting to the real operator; some phishing kits instead showed a failed-payment page to prompt entry of a second card.

The scheme took money either by charging an inflated one-off parking fee, with the Watchet site reported as charging up to £50, or by routing the victim to an unauthorized app that enrolled them in a paid subscription behind a small upfront verification fee, as in Castleford where a 90p fee was followed by a £39 charge with no refund. The Chartered Trading Standards Institute's position is that small opening charges, £2.99 in Katherine Hart's example, are chosen to stay below the threshold of suspicion while still capturing usable card data.

Per Katherine Hart, captured card and personal data is often reused days or weeks later, with fraudsters calling victims while impersonating their bank, the police or Trading Standards and citing the exact date of the original transaction as proof of legitimacy in order to extract much larger sums. This stage is her account of the pattern rather than something documented in the council incidents here.