New quishing alert: £3.5 million lost last year to fraudulent QR codes

Action Fraud is urging people to look out for rogue QR codes, after 784 reports of ‘quishing’ were made to Action Fraud between April 2024 and April 2025, with almost £3.5 million lost.

A new alert has been issued by Action Fraud, warning about quishing, a form of phishing where a fraudulent QR code is scanned, designed to steal personal and financial information. The warning encourages people to stay vigilant and double check QR codes to see if they are malicious, or have been tampered with, before scanning them online or in public spaces. 

 

Claire Webb, Acting Director of Action Fraud, said: 

“QR codes are becoming increasingly common in everyday life, whether it’s scanning one to pay for parking, or receiving an email asking to verify an online account. However, reporting shows cyber criminals are increasingly using quishing as a way to trick the public out of their personal and financial information. 

“We’re urging people to stop and check before scanning QR codes, to avoid becoming a victim of quishing. Look out for QR codes that may have been tampered with in open spaces, or emails and texts that might include rogue codes. If you’re in doubt, contact the organisation directly. You can follow our advice on quishing, on our website at www.actionfraud.police.uk to help protect yourself.”

 

Action Fraud can reveal that quishing happens most frequently in car parks, with criminals using stickers to tamper with QR codes on parking machines. Quishing also occurred on online shopping platforms, where sellers received a QR code via email to either verify accounts or to receive payment for sold items. 

 

Reports also showed phishing attacks were taking place impersonating HMRC, or other UK government schemes, targeting people with QR codes designed to steal personal and financial details. 

What can you do avoid being a victim of quishing?

QR codes used in pubs or restaurants are usually safe to scan.

Scanning QR codes in open spaces (like stations and car parks) might pose a greater risk. Check for signs that codes may have been tampered with (usually by a sticker placed over the legitimate QR code). If in doubt, do not scan them: use a search engine to find the official website or app for the organisation you need to make a payment to.

If you receive an email with a QR code in it, and you're asked to scan it, you should be cautious due to an increase in these types of 'quishing' attacks.

Finally, we recommend that you use the QR-scanner that comes with your phone, rather than using an app downloaded from an app store.

If you receive a suspicious email, report it by forwarding it to phishing@report.gov.uk 

Find out how to protect yourself from fraud: https://stopthinkfraud.campaign.gov.uk

If you’ve been a victim of fraud, report it at www.actionfraud.police.uk or by calling 0300 123 2040. In Scotland, contact Police Scotland on 101.

Source: Action Fraud (20-06-2025)

Don't Get Hooked! The UK is Fighting Back Against Phishing Scams – Here’s How You Can Help

It's a digital world out there, and unfortunately, that means a constant barrage of sneaky scams trying to reel us in. But here in the UK, we're not just sitting ducks – far from it! Recent figures show a monumental effort from the public in reporting suspicious emails and texts, leading to significant disruption of cybercrime.

As of April 2025, an incredible 41 million phishing scams have been reported to the Suspicious Email Reporting Service (SERS) since its launch in April 2020. This astounding collective action has empowered the National Cyber Security Centre (NCSC) to take down a staggering 217,000 scams across 393,395 website pages. That’s a serious dent in the criminals' operations!

Who Are They Impersonating?

Action Fraud, the national fraud and cybercrime reporting service, has revealed that the top industries impersonated in these reported phishing attempts are familiar faces: streaming services, tech and telecommunication companies. Even various UK government schemes have been mimicked, highlighting the diverse tactics criminals use to trick us.

Your Phone is Your Weapon: Reporting Texts and Calls

It's not just emails. Those annoying spam calls and suspicious text messages can also be reported, and it makes a real difference. By forwarding suspicious text messages to 7726, a free service offered by mobile network providers, you're helping to remove scam websites and allowing networks to block those sending scam texts. Between April 2020 and April 2025, over 27,000 scams were removed thanks to this simple action.

Superintendent Amanda Wolf, Head of the National Fraud Intelligence Bureau at the City of London Police, stresses the importance of every single report: "Every phishing email reported helps us gain a better understanding of the tactics being used and enables us to tackle it head on by identifying malicious URLs trending in phishing emails and texts - they can be taken down and disrupted, preventing further activity. The more reports received, the more people we can protect, preventing them from becoming victims."

Sarah Lyons, NCSC Deputy Director for Economy and Society Resilience, echoes this sentiment: "Since 2020, over 41 million phishing attempts have been reported to the Suspicious Email Reporting Service — a powerful sign that the public is staying alert to online threats, helping to protect themselves and others."

So, What Exactly Is Phishing?

In simple terms, 'phishing', ‘quishing’ (using QR codes), or ‘smishing’ (via text messages) is when criminals use fake communications – emails, texts, QR codes, or phone calls – to trick you. Their goal? To get you to click a malicious link, scan a fraudulent QR code, or divulge personal and financial information on a genuine-looking but fake website. They often impersonate well-known brands or organisations you already have a connection with to make their scams more convincing.

How Can You Protect Yourself? Stay Alert!

The key is to STOP, THINK FRAUD. If something doesn't feel right, it probably isn't.

If you’ve received an email that doesn’t feel right, STOP!

• Break the contact: Don’t reply, click on any links, call any phone numbers, or make any payments.
• Check if it’s genuine: Contact the organisation directly using a known, correct email address or phone number (e.g., from your utility bills, their official website, or by calling 159 for banks).
• Before you delete it, forward it to: report@phishing.gov.uk

If you’ve received a text message that doesn’t feel right, STOP!

• Break the contact: Don’t reply, click on any links, call any phone numbers, or make any payments.
• Check if it’s genuine: Contact the organisation directly using a known, correct email address or phone number.
• Forward the message for free to: 7726

If you’ve received a call that doesn’t feel right, STOP!

• Hang up!
• Check if it’s genuine: Contact the organisation directly using known, correct contact details.
• Don’t trust Caller ID: It can be faked!
• Report it: Send a text to 7726 with the word ‘call’ followed by the scam caller’s number.

For more comprehensive advice on protecting yourself from fraud, visit: https://stopthinkfraud.campaign.gov.uk/

What if you've been caught out?

If you've unfortunately lost money or provided financial information as a result of a phishing scam, notify your bank immediately. Then, report it to Action Fraud at https://www.actionfraud.police.uk/ or by calling 0300 123 2040. In Scotland, call Police Scotland on 101.

Every report counts. By staying vigilant and reporting suspicious communications, we're all playing a crucial part in making the UK a safer place online. Don't get hooked – keep reporting!

Source: Action Fraud (02-06-2025)