The scam is physical and simple, which is why it works. Someone prints a QR code sticker and places it neatly over the genuine one on a car park sign or the payment machine itself. You scan it, expecting the council or the operator, and land on a page that looks entirely plausible - the right car park name, the right sort of form, a box for your card. Nothing about the moment feels wrong.

The small ask is the parking fee, and just like the fake delivery texts, the fee is not the point. Entering your card details on that page hands the criminals a live, working card and a person willing to use it. The real loss tends to arrive later, as a larger charge or a follow-up call about a “suspicious payment”, using the details you have just confirmed are yours.

What makes it convincing is that it exploits a habit we have all been trained into. QR codes on official signs are now normal, we scan without thinking, and a sticker looks exactly as authoritative as the print underneath it. The genuine machine standing a few feet away, working perfectly, does nothing to break the illusion, because you never needed it.

The defence costs nothing and slows you down by seconds. Look at the code before you scan - a sticker sitting proud of the sign, slightly crooked or a different finish, is the tell. Better still, pay at the machine, or use the operator's own app that you downloaded yourself rather than one a QR code offers to install. If a scanned page asks for card details on an unfamiliar web address, stop.

If you have already paid through one of these, treat it as a card compromise, not just a lost parking fee. Ring your bank on the number on the card, watch for the follow-up call, and report the location so the sticker can be removed before the next driver scans it.