Scam Alert: Holiday Booking Fraud and Fake Parking QR Codes Are Hitting Hard This Summer
Two very different scams are catching people out right now, and both are tied to summer. One empties your bank account before your holiday even starts. The other waits for you in a car park. Neither one cares how careful you normally are.
July is the worst month of the year for holiday booking fraud, so the timing here isn't an accident. Scammers know exactly when people are searching for last-minute deals. Here's what to watch for.
1. Fake Holiday Bookings
You find a gorgeous apartment or a cheap deal on flights, pay by bank transfer, and hear nothing until you turn up at the destination and there's no booking. That's the shape of it. According to Action Fraud's summer holiday alert, UK victims lost over £11 million to this in 2024 across 6,066 reports, and July alone brought in 647 of them. The average loss was £1,844. That's a proper holiday's worth of money gone.
The way it works is clever. Criminals clone real travel company websites, right down to URLs that are one letter off the genuine one. They post fake listings for apartments and hotels on social media and on sites people already trust. The photos are real, lifted from somewhere else. The property either doesn't exist or was never available. You pay, and the money's gone the second it leaves your account.
There's a nastier version doing the rounds too. Fraudsters break into legitimate hotel accounts on Booking.com and message guests who've already booked, asking for an urgent payment through a new link or the reservation gets cancelled. Action Fraud put out a specific warning about the Booking.com version. Because the message comes through the real platform, from what looks like the real hotel, people pay without a second thought.
The pressure is the giveaway. Countdown timers ticking down. "14 people are looking at this right now." Everything pushing you to pay this minute before you've had a chance to think. Real bookings don't fall apart if you take an hour to check.
Before you pay anything: look for the ABTA or ATOL logos and check they're genuine on the ABTA site, pay by credit card rather than bank transfer so you've got protection, reverse-image-search the property photos to see if they're stolen, and phone the accommodation directly on a number you found yourself to confirm the booking exists.
2. Fake QR Codes on Parking Machines
This one you scan with your own phone. Criminals print a fake QR code sticker and stick it right over the real one on a pay-and-display machine. You scan it, land on a convincing copy of PayByPhone or RingGo, tap in your card details, and pay. The money goes to the scammer. Your parking never registers. Then you get a penalty notice on the windscreen on top of everything else.
It's spreading fast. Between April 2024 and April 2025 there were more than 780 reports and around £3.5 million lost to QR code scams, which now make up over a fifth of all online fraud. The parking version alone is estimated to cost around £10,000 a day. One woman in Thornaby had £13,000 taken after scanning a dodgy code.
Some councils have gone out of their way to make the point clear. Hartlepool Borough Council confirmed their machines have never used QR codes at all, so any code you see stuck on one is fake by definition. That's a useful rule for a lot of places. If a code has appeared where there wasn't one before, treat it as suspect.
It isn't only car parks. The same trick is turning up on EV chargers, bike-share docks, and even QR codes on tables in food courts. Anywhere you'd expect to scan and pay, someone might have got there first. Friends Against Scams has a good rundown of how this "quishing" works if you want more detail.
The fix is simple. Don't scan stickers on machines. Use the keypad on the machine, pay by card, or open the parking app you already know and trust and type the location code in yourself. Never let a sticker send you to a payment page.
If It's Already Happened
If you've paid a fake booking, scanned a dodgy code, or handed over card details:
- Call your bank straight away. The number on the back of your card. Card payments and transfers can sometimes be stopped or recovered if you're quick, and a credit card gives you the best chance of a chargeback.
- Change your passwords. Start with your email, since that's the one used to reset everything else, then any account that shared the same password.
- Run a full scan with Windows Defender or your antivirus if you clicked a link or entered anything on a device, just to be sure nothing came along with it.
- If you gave anyone remote access to your computer while sorting a "refund" or a booking problem, get the machine checked. A remote-access tool left running is a door left open.
How to Report Scams
- Scam text → forward to
7726(spells SPAM, free on all UK networks) - Scam email → forward to
report@phishing.gov.uk - Scam website → report at ncsc.gov.uk
- Fraud of any kind → Action Fraud on
0300 123 2040or actionfraud.police.uk
Reporting genuinely helps. The mobile scam filters and the NCSC's reporting service both work on volume, so every report makes the next fake site or number easier to shut down. It takes two minutes and it's not wasted.
And if a scammer talked you through installing something to "sort out a refund" or had remote access to your machine at any point, don't just hope it's fine. I handle virus and malware removal in St Helens and can check the PC over properly to make sure nothing was left behind.
Mark has been fixing computers since the late '90s and went self-employed in 2008. Based in St Helens since 2013, he works evenings and weekends from his home in Laffak — friendly, affordable repairs for PCs, laptops, and Macs. See reviews on Google
Think you've been scammed? Or had someone on your PC?
If you've let someone remote in, installed dodgy software, or just want your PC checked over — get in touch and I'll have a proper look.
★★★★★"Absolutely fantastic service from Local Computer Guy, I was unable to help my grandparents with their computer issues after an unfortunate issue with a scammer and potential virus being installed on their machine. After a quick call I knew they were in good hands. Arrived on time and quickly wiped the machine and made it safe, also helped investigate what had happened and helped my grandparents get using their computer again."
— Joe Gempton, via Google