Action Fraud received 784 reports of “quishing” between April 2024 and April 2025, with almost £3.5 million lost, according to a press release it issued on 20 June 2025. Quishing is phishing by QR code: a fake code, usually a sticker over a genuine one, that sends whoever scans it to a site built to take their card details. Action Fraud said it happened most often in car parks, on payment machines.
That warning was aimed at the public, and it was picked up. Which? published its own guide to spotting dodgy codes five days later. For a holiday park that has put QR codes on its signs, the message guests have been given is worth reading closely, because some of it describes your park.
What guests have been told
The National Cyber Security Centre’s view, set out in a February 2024 blog post, is a measured one. It says QR codes in pubs and restaurants are “probably safe” to scan, and that scanning in open spaces such as stations and car parks “might be riskier”. The Action Fraud release draws the same line between trusted indoor places and open public ones.
The practical advice in the Action Fraud release and the Which? guide comes down to a few habits. Look at whether the code has been stuck over something. Check that the web address the phone shows matches what you expected. If in doubt, do not scan, and type the address or search for the organisation instead. Which? goes further and suggests avoiding QR codes for payments where possible, and treating codes that arrive by email with suspicion.
A holiday park sits on both sides of the NCSC’s line. Reception and the clubhouse feel like the pub. The car park, the barrier, the post on the path down to the beach feel like the station. A guest who has absorbed the advice will scan the first without thinking and may hesitate over the second, which is often exactly where a park puts the code for its map.
Make the code look like it belongs
None of this means taking QR codes down. It means making a genuine code easy to tell from a fake one, using the same checks guests have been told to run.
Print the code into the sign. A code that is part of the printed panel, under the same laminate or behind the same glass, passes the “has this been stuck over something” test. A code added later on a sticker looks, to a cautious guest, exactly like the thing they were warned about, even when you put it there yourself.
Print the web address beside it. It costs one line of text and gives the wary guest the alternative the advice recommends: type it in. It also lets anyone check that the address their phone shows matches the sign. A short address on the park’s own domain is easier to check than a long string from a link shortener or a QR generator service, because the guest recognises your name in it.
Say what the code does. “Scan for the park map” sets an expectation the guest can check against what opens. A bare code invites the question of where it goes.
Keep payments off signs. The fraud Action Fraud describes is about taking personal and financial details. A code that opens a map, a menu or a list of opening times has nothing to steal. If a guest scans the map code by the bins and gets asked for a card number, they should know straight away that something is wrong.
Put the code where guests already trust you
The other half is placement. If the NCSC’s line between trusted and open places holds, the strongest spot for a code is the one guests already treat as yours: on the reception desk, on the welcome screen, in the printed welcome pack, at the till in the shop. A guest who scans the park map once at reception has it on their phone for the week, and does not need to trust a code on a post later.
Codes outdoors still have a job, especially at junctions and on the walk from the car park. Those are the ones to check on a site walk, the same way a broken bulb or a faded arrow gets noticed. A sticker on top of a printed code is easy to spot if somebody is looking for it.
Email is the exception that runs the other way. The NCSC and Which? both single out QR codes in emails as a common route for phishing, because they hide the link. In a booking confirmation, a plain link to the map does the same job as a code and does not ask the guest to override what they have been told.
What the figures do not say
Seven hundred and eighty-four reports is a national figure across every kind of setting, and the NCSC is clear the problem is small next to other fraud. There is nothing in these sources about holiday parks specifically, and no reason to think parks are being targeted. The point is narrower than that. Guests have been taught a set of checks, and a park’s own codes should pass them without the guest having to think.
