A fake QR code car park sticker was found on a parking meter at the Rockfield car park in Oban, Scotland, and Police Scotland is investigating. Scanning it reportedly sent drivers to an unrelated website that could have asked for payment details. It is a small case, but it shows exactly how this scam works and what the people who run car parks can and cannot do about it.
What happened in Oban
The Highland Times reported on 4 November 2026 that Police Scotland had warned drivers after a fraudulent QR code sticker was placed on a parking meter at Rockfield car park. According to the report, officers were alerted on the afternoon of Friday 30 October. The sticker redirected anyone who scanned it to a website with no connection to the car park, one that could ask for payment and so put card details at risk.
The stickers have since been removed, and police are still working out how they were put there and by whom. The report says there is no police confirmation that anyone lost money. Anyone with information is asked to contact Police Scotland on 101. We are relying on that one local report, so details may change as the investigation continues.
Why a fake QR code car park sticker works
A QR code is a grid of squares, and looking at it tells you nothing about where it goes. A pasted-on fake looks as official as the real thing. A sticker costs pennies to print, a meter is unattended, and the driver scanning it is in a hurry to pay and leave. The fake page often looks like a payment screen, collects the card number, and may leave the driver with no proof of parking.
It is not a one-off
Councils across the UK have said the same thing in the past year. In April 2026, Cumberland Council reported stickers with fake QR codes in Carlisle car parks, including Swifts Bank, the Civic Centre and Lowther Street, which led to malicious payment websites. The council removed them and said it does not use QR codes in its car parks. In September 2025, Hartlepool Borough Council warned that codes on pay-and-display machines were fake and that people had reported several payments taken from their bank accounts after entering card details.
We covered a run of similar cases elsewhere in our article on fake QR code stickers on parking meters. Oban is the latest, and the pattern is the same each time: a physical sticker, an unattended machine, a lookalike payment page.
What software cannot fix
We make a dynamic QR code platform, so it is worth being plain about the limits. The sticker in Oban was not created on anyone's account, and nobody can switch it off from a dashboard. A QR platform cannot stop a person gluing a sticker over a code, and it cannot remove it afterwards. That job belongs to people who walk the site.
Anything on the web that claims to make a printed code "tamper-proof" is overselling. The honest position is that the first line of defence is physical: inspect, photograph, remove.
How a dynamic QR code helps a car park operator
If you run a car park, venue or any site where customers scan a code to pay or get information, a dynamic QR code gives you tools to spot trouble and respond faster. These are things we can confirm the product does.
- One code per location. If every machine has its own code, the scan log shows which location has gone quiet. QR code tracking records each scan with its country, city and device. A code that normally logs scans daily and suddenly logs none, while footfall is unchanged, is a reason to go and look. It is a hint, not proof, because your genuine code may be perfectly fine and simply covered.
- Clean numbers. Bot filtering keeps link previews and crawlers out of the counts, so a quiet code really is quiet.
- Alerts on busy codes (Pro). Scan alerts and webhooks are available on the Pro plan, so an unusual spike or drop can reach you or your own systems without anyone refreshing a dashboard.
- Re-point or pause in seconds. If your genuine code is still visible and you learn of a scam, you can point it at a notice such as "beware of stickers, pay at the machine or in our app" and every printed copy updates at once. You can also pause it entirely.
- Controls per code. Country restriction, a password and an expiry date can be set on individual codes. Codes have no expiry unless you set one, and free-plan codes stay live.
- A recognisable address. On the Pro plan, a code can run on your own domain, so the preview a phone shows names your organisation. See how to use a custom domain for your QR codes.
- A way to pay without trusting a sticker. A short custom short link printed in words beside the code gives drivers something they can type instead of scan.
What drivers should do
- Look for tampering. A sticker over existing signage, or a code that looks newer or larger than the rest of the machine, is a warning sign.
- Read the address your phone shows. If it does not match the operator named on the machine, close it.
- Pay through an official channel. The machine's own screen, the operator's official app or a kiosk. Cumberland Council said it will never put stickers over card readers, and Hartlepool Council has said QR codes on its machines are fake.
- If you already entered card details, contact your bank at once and report the sticker to the police.
For the wider picture on safe scanning, read are QR codes safe?
What councils and venue owners should do now
- Inspect machines on a regular schedule and remove stickers on sight.
- State on the machine whether QR payment exists at all. If it does not, say so in plain words.
- Photograph every genuine code in place so a swap or overlay is obvious to the next person on patrol.
- Give each genuine code its own name and location in your records, and check its scan history after any report of stickers nearby.
- Tell customers where to report suspicious stickers and make that route easy.
If you are starting from scratch, our guide on what a dynamic QR code is explains why a redirect you control is easier to manage than a code with the address baked in.
The takeaway from Oban
The Oban report is short on figures, and that is part of the lesson: nobody yet knows how long the sticker was there or how many people scanned it. A genuine code you can measure, pause and re-point will not stop a fake from appearing, but it shortens the time between a problem appearing and you noticing it. The sticker still has to be peeled off by a person.