The National Cyber Security Centre joined Heathrow and Gatwick operators in warning that organised crime groups are overlaying fraudulent QR stickers on express pick-up lane payment boards, steering drivers to cloned pay-by-phone sites that harvest card details before legitimate airport charges register—part of a wider “quishing” wave Action Fraud tied to 1,386 UK reports last year and fresh clusters near M25 terminal forecourts this September.
What broke
Security teams at both airports told InfoHandle that weekend patrols removed at least nine tampered boards across short-stay pick-up zones where drivers normally scan official codes to pay drop-off fees by phone. Stickers sat flush over genuine QR prints on laminated instructions; URLs resolved to domains registered days earlier through privacy proxies, mimicking colour palettes of approved payment partners without hosting on airport-controlled infrastructure.
One driver who contacted trading standards in Hounslow said she paid £7.50 through a spoof portal while waiting in a Terminal 5 express lane, then received a penalty notice from the legitimate operator because no payment reached its merchant ID. Her bank flagged a recurring £29.99 “parking subscription” two days later—a pattern Which? and Derbyshire police documented on council car parks when criminals bolt monthly traps after a single card capture.
What NCSC confirmed
The NCSC’s public guidance already ranks open-space QR scans as higher risk than pub menus because criminals can physically swap codes without breaching corporate networks. Weekend advisories sent to airport security chiefs restate that principle for aviation forecourts where drivers are rushed, engines idling, and children unloading luggage. Officials did not attribute the stickers to a named group; the National Crime Agency’s fraud desk is sharing indicators with regional forces under existing cyber-enabled fraud protocols.
Heathrow said legitimate pick-up payments should be made only through URLs printed on its own signage or the official app, never through third-party stickers. Gatwick echoed that drivers should type known domains manually if a code looks new. Both airports increased board inspection cadence to twice daily on express lanes while reviewing whether to retire QR entirely on kerbside signs—National Car Parks told the BBC it is weighing the same step after two of its 800 sites were hit.
Who has the file
Action Fraud opened a thematic reference for airport-lane reports; Metropolitan Police aviation security liaisons are correlating merchant IDs from victim statements. Payment processors used on genuine airport flows said they are rotating short links more frequently so cloned pages cannot reuse old redirect chains. Mobile networks received SS7-adjacent phishing templates stripped from SMS follow-ups that some victims reported after failed scans—calls claiming to be “airport payment support” asking for one-time passcodes.
Trading standards officers in Slough and Crawley are photographing sticker stock to trace adhesive batches. No arrests are public; investigators treat the campaign as affiliate fraud rather than insider compromise of airport IT.
What is still unknown
Airports have not published total losses or how many penalties were wrongly issued before appeals. It is unclear whether the same crew operated council car parks along the M4 corridor or whether express-lane targeting exploits higher drop-off tariffs that make drivers less likely to dispute small charges immediately.
NCSC analysts have not said whether iOS and Android camera previews would have flagged the rogue domains; victims overwhelmingly used built-in scanners, consistent with agency advice against third-party QR apps.
What drivers should do
Before scanning, peel sticker edges gently—legitimate airport laminates are flush with the board and carry embossed airport crests without peel tabs. If in doubt, navigate to the operator website manually or use contactless where offered. Report tampered boards to airport security desks before leaving the forecourt so CCTV can capture installers.
Anyone charged twice should dispute the subscription with the card issuer within 24 hours and appeal parking penalties through the operator’s published process, citing Action Fraud reference numbers. Keep screenshots of the URL bar; prosecutors use them to map hosting hops even when sites go dark within hours.
Operator read-through
Aviation pick-up fees fund congestion management; fraud undermines compliance because honest drivers pay penalties while criminals harvest cards. Airport groups told the Department for Transport’s aviation consumer panel that QR was adopted to speed kerb turnover, but physical stickers exploit the trust placed in wayfinding signage. Until boards are hardened or removed, the NCSC’s message is unchanged: treat express-lane codes like strangers handing you a shortened link—verify before you pay.
Fleet operators running hotel shuttles said they are briefing drivers to warn passengers, especially inbound tourists unfamiliar with UK pay-by-phone norms. For now the confirmed facts are narrow: stickers appeared, official warnings went out, and patrol frequency rose. Everything else—scale, attribution, permanent signage policy—remains under investigation.