Organised gangs behind rise in QR 'quishing' scams
bbc.com
bbc.com
We do not need to coin a new term for each one of these things and nobody is winning any prizes for adding more layers of abstraction to fight through when trying to communicate security concepts to the people who really need to listen to it.
Our workplace cybersecurity training introduces at least 1 new word each year. This year's was "vishing" which apparently is just social engineering/credential extraction that takes place over the phone. Of course, it's presented to non-technical users as a well-adopted term that is very important to know (for the checkbox quiz in 3 slides time).
What makes it doubly so is that the parking companies have been removing the parking machine terminals in some locations. The Royal BC Museum in Victoria BC comes to mind last time I was there. I'd be surprised if someone hasn't at least tried a QR code scam on it by now.
The websites (if they exist) are usually about as bad.
Car parks make more money if they can fine you, so there's no incentive to make payment easy or make it work reliably.
It should be like cryptocurrency where there is a separation of the public and private key. Or even better, something like chaumian e-cash. I feel like that would pretty much shut down the majority of financial crime.
Here in the UK we had car payment stations: You enter your car registration number, you pay by card or contactless. Done. Safe. It works.
BUT, this is more expensive for the operator to install and maintain than just sticking a notice to tell you to install an app and to use it to pay.
That being said, usually the QR code is not required it is just to make it "easier" as the notice explicitely says which app to install and provides the unique reference of the car park, too. You may also be able to pay over the phone rather than using the app. This is all shown on the article's first picture.
So, really they could just remove those scam-prone QR codes. I suspect that they don't care, though, and even profit from those scams since they can fine you for not having actually paid.
https://www.theguardian.com/money/2025/feb/22/uk-wide-parkin...
There are indeed pay machines, and removing them is only a profit-squeezing play by the operators.
You also never need the QR code. It's only provided as a "convenience". And in fact they usually also provide a way to pay by phone (see illustrative picture in article).
So these are all issues created by bad engineering and operators trying to squeeze as much as they can without consideration for the users.
Right, but does it matter if it’s an app or a website?
> There are indeed pay machines, and removing them is only a profit-squeezing play by the operators.
Yes, and?
> You also never need the QR code. It's only provided as a "convenience". And in fact they usually also provide a way to pay by phone (see illustrative picture in article).
Of course you don’t need a QR code specifically, but you probably need some kind of URL (which can then be imitated by the scammer) so everyone can pay.
> So these are all issues created by bad engineering and operators trying to squeeze as much as they can without consideration for the users.
I wouldn’t call it bad engineering, it’s a tradeoff. Either expensive machines for every parking space or a simple sign with a QR code.
It also makes it far easier for parking monitoring - with a description of each vehicle and the registration plate, a traffic warden can easily look at the cars parked in a particular area, discount the ones that have an active parking session, and focus their attention on the vehicles that have exceeded the allowed booking, or have bought a paper ticket from the machine.
It also means that you can do an approximation of real-time capacity in parking areas, without having to go to the expense of installing sensors in parking bays etc.
So lots of advantages, I think, over cash. The obvious downside is when the app doesn't work (I've had this happen on occasion) and for drivers who don't have smart phones (a small number, I think, but still worth considering) or technically less adept users - some of these apps have truly awful UX, which I've struggled with on occasion, so for people who struggle with technology, and particularly perhaps older people, they may be exclusionary. However, in most areas, you can still pay via the machine.
I think contactless is as easy and convenient as it gets. Enter registration number, tap, done.
If the government wanted to madate something useful for consumers it should mandate pay machines instead of app/phone only as some car parks now are.
The only reason these apps are becoming ubiquitous is that they are cheaper for the operators than installing and maintaining pay machines. That is it.
Contactless is easy - but there's a far higher cost (each machine needs to have connectivity etc). Plus it doesn't let you extend remotely, which is something I use very regularly. I guess from a user perspective that's a benefit, but from an operator perspective it's a potential downside - would I pre-pay for more parking if I couldn't extend? Probably. But would I potentially park elsewhere, for a car park where you pay on exit, thus removing that revenue from them entirely? Possibly. I guess it would depend on lots of factors, and my one-person study is perhaps not the most reliable data!
I agree that they are becoming ubiquitous because they are cheaper for operators, but I don't think that this is the only reason: I do think that they genuinely offer greater utility than a pay at machine with contactless option.
Interested to know what you mean "monitoring is already done by ANPR" because this is not my experience where I am based. Do you mean street based parking, or in car parks?
For the street based parking where I am the traffic wardens have a tablet that shows them the make, model, registration number of the vehicles parked in a particular area, and generally make their patrols on foot, so I'm not sure there's any ANPR being used. I guess there could be CCTV cameras cover exit and entry points to particular locations, but in European countries and the UK I'm pretty sure that there need to be notification signs that your registration plate is being captured in that situation.
Barring vulnerabilities in your QR reader, it should be enough to just read the URL.
If enough people do it, they'll find a way to solve the problem (e.g. a subdomain of the official city site, putting back regular parking meters/machines, ...)
I think the situation is dire when it comes to non-technical users, but I don't think QR codes are the problems here, someone could equally well paste a sticker over the entire board with all the URLs replaced or with details of a completely different (fake) parking company (but I agree replacing QR codes probably makes it harder for an employee to spot).
If there's no machine to pay directly, no attendant, not a city owned lot, and no verifiable payment site online... I'd be inclined to do what someone else suggested and just not pay and see what happens.
The real solution seems like it should be a physical payment machine that accepts credit cards/cash. Those could also be fake, but much much harder to pull off successfully. (easier to track fraudulent credit cards processors, and no chance of leaking CC credentials with EMV contactless)
My experience is that Easypark works in most of Europe and is great because of that. I trust them, and that's all I need. I really avoid QR codes, and I don't want to install your little local app.
Another commenter in this thread says parking works well in China, because WeChat is the trusted middle man.
Sadly, as always, winner takes it all has its benefits in terms of ease of knowing what to trust.
[Not saying there are no scams in India. Just that QRs for payments are very popular here as well, and scammers are smart and active, so was wondering why not]
The real solution is establishing a trusted channel - citizens need to know they should only pay for municipal parking through their city's official domain (e.g., sf.gov/parking). But this isn't possible when it's some random parking company. I don't see a great solution.
I'm convinced the only responsible solutions are chip-only payment processors and conventional coin machines, as pricey as they are.
How about we have people give small bits of paper to other people to pay for things? Or maybe even wave small cards of plastic in front of things that can read them? Maybe how about not using my fucking phone for every goddamn thing?
Crazy, right? KTHXBYE.
The fact that parking systems won't install wireless credit card readers and instead will foist the externality onto me of 1) having a phone, 2) that is currently charged, 3) has a relatively high resolution camera, and 4) capable of high bandwidth internet access is the kind of thing that ticks me off.
The sweet spot is probably around contactless, but eventually more countries will get things like Vipps or WeChat pay and it will become a unified experience.