--- title: QR Code Scams Have Moved From the Car Park to the Inbox description: Fake QR codes have spread from parking meters to inboxes. Here’s how QR scams target New Zealand businesses, and the habits that stop them. image: https://manux.nz/hubfs/yellow-warning-sign-over-a-red-qr-code-on-white-fa-2026-10-02-03-42-48-utc%20(2).jpg --- [Skip to content](https://manux.nz/blog/qr-code-scams-have-moved-from-the-car-park-to-the-inbox#main-content) Close - [OUR APPROACH](https://manux.nz/our-approach) - [SERVICES](https://manux.nz/services) - [Consulting & Strategy](https://manux.nz/services/consulting-strategy) - [Business Transformation](https://manux.nz/services/business-transformation) - [Cloud & Infrastructure](https://manux.nz/services/cloud-infrastructure) - [AI & Automation](https://manux.nz/services/ai-intelligent-automation) - [Business Continuity](https://manux.nz/services/business-continuity) - [Cybersecurity](https://manux.nz/services/cybersecurity) - [Support & Procurement](https://manux.nz/services/support-procurement) - [M-FILES](https://manux.nz/m-files) - INSIGHTS - [Blog](https://manux.nz/blog) - [Case Studies](https://manux.nz/case-studies) - [ABOUT US](https://manux.nz/about-us) SEARCH [CONTACT US](https://manux.nz/contact) [![logo](https://manux.nz/hs-fs/hubfs/Manux%20Logo%20-%20Main%20(Expanded)-1.png?width=125&height=31&name=Manux%20Logo%20-%20Main%20(Expanded)-1.png "logo")](https://manux.nz/) - [OUR APPROACH](https://manux.nz/our-approach) - [SERVICES](https://manux.nz/services) - [Consulting & Strategy](https://manux.nz/services/consulting-strategy) - [Business Transformation](https://manux.nz/services/business-transformation) - [Cloud & Infrastructure](https://manux.nz/services/cloud-infrastructure) - [AI & Automation](https://manux.nz/services/ai-intelligent-automation) - [Business Continuity](https://manux.nz/services/business-continuity) - [Cybersecurity](https://manux.nz/services/cybersecurity) - [Support & Procurement](https://manux.nz/services/support-procurement) - [M-FILES](https://manux.nz/m-files) - INSIGHTS - [Blog](https://manux.nz/blog) - [Case Studies](https://manux.nz/case-studies) - [ABOUT US](https://manux.nz/about-us) [CONTACT US](https://manux.nz/contact) ![yellow-warning-sign-over-a-red-qr-code-on-white-fa-2026-10-02-03-42-48-utc (2)](https://manux.nz/hs-fs/hubfs/yellow-warning-sign-over-a-red-qr-code-on-white-fa-2026-10-02-03-42-48-utc%20(2).jpg?width=575&name=yellow-warning-sign-over-a-red-qr-code-on-white-fa-2026-10-02-03-42-48-utc%20(2).jpg) # QR Code Scams Have Moved From the Car Park to the Inbox [Previous Post](https://manux.nz/blog/more-security-data-will-not-keep-you-safe.-faster-decisions-will) *28 October 2026* In July, Christchurch City Council warned motorists after fake QR code stickers were found on parking machines across the city. Scammers had scribbled over the meter screens with permanent marker, so drivers would scan the sticker instead and land on a fake payment page. [(Source: 1News, Christchurch parking meters)](https://www.1news.co.nz/2026/07/14/fake-qr-code-payment-stickers-found-on-christchurch-parking-meters/) It didn’t stay in Christchurch. Wellington City Council removed about a dozen fake stickers from its meters, and Auckland Transport then found scam stickers in its city centre. [(Source: RNZ, Scam car park QR codes spreading across NZ)](https://www.odt.co.nz/canterbury/christchurch/scam-car-park-qr-codes-spreading-across-nz-wcki17ti) We covered the Christchurch case in our September look at [two new security reports](https://manux.nz/blog/you-are-the-target-what-two-new-security-reports-mean-for-everyday-new-zealanders). As a Christchurch-based team, it was a story close to home. But there’s a business version of this scam, and it matters more. The sticker on a parking meter is the version you can see. The one aimed at your business arrives in your inbox. ### Why QR codes get a free pass QR codes are part of everyday life now. We scan them to pay, to order, to sign in and to track a parcel. That familiarity is exactly what makes them useful to attackers. You can hover over a link in an email and check where it goes. You can’t do that with a QR code. You only find out where it leads after you’ve scanned it. ESET’s New Zealand team points out that when a code appears somewhere familiar, like a parking machine or a delivery notice, people are much less likely to question it. [(Source: ESET, SecurityBrief NZ)](https://securitybrief.co.nz/story/qr-code-scams-now-one-in-10-threats-in-new-zealand) ### The workplace version At work, the QR code usually arrives in an email or a PDF attachment. It’s often dressed up as a Microsoft security alert asking you to update your multi-factor authentication [(Source: Secureworks via Sophos, QR phishing incident)](https://www.sophos.com/blog/qr-phishing-leads-to-microsoft-365-account-compromise), or as an NZ Post notice saying a parcel is held at Customs [(Source: RNZ, QR codes latest scam)](https://www.odt.co.nz/business/qr-codes-latest-scam-take-your-money-rnz). Scanning it moves the attack from your work computer to your phone, away from the email filtering and security tools that protect your work accounts. The page that opens looks like an ordinary login screen. Whatever you type into it goes straight to the attacker. This is a large-scale problem. Microsoft tracked QR code phishing rising from 7.6 million attacks in January 2026 to 18.7 million in March, a 146% increase over the quarter. By March, 70% of those attacks were hidden in PDF attachments. [(Source: Microsoft Threat Intelligence, Q1 2026)](https://www.microsoft.com/en-us/security/blog/2026/04/30/email-threat-landscape-q1-2026-trends-and-insights/) It’s a local problem too. ESET reports that QR code scams now make up about one in 10 threats it detects across its New Zealand users, and their share has more than doubled since March. [(Source: ESET, New Zealand threat data)](https://www.chillisoft.net/eset-data-shows-qr-code-scams-on-the-rise/) Microsoft’s later figures add a detail worth noticing. QR phishing volumes fell after March, but the packaging changed: by June, Word documents carried 40% of QR attacks. [(Source: Microsoft Threat Intelligence, Q2 2026)](https://microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights) Attackers adjust quickly. Telling staff to watch out for one file type won’t hold up for long. What holds up is a habit. ### What to tell your team None of this needs technical knowledge. A few simple habits close most of the gap. Treat any QR code in an email or attachment with suspicion, especially one asking you to log in, make a payment or update your security settings. Before you open the link, check the URL preview your phone shows, and don’t open it if it isn’t the site you expected. [(See also: NCSC, QR codes: think before you scan)](https://www.ncsc.govt.nz/insights-and-research/insights-reports/quarter-two-cyber-security-insights-2026/qr-codes-think-before-you-scan) If a request is unexpected, confirm it another way, by calling the sender or going to the website directly instead of using the code. And if something feels off, tell IT straight away, even if you’ve already scanned it. A quick report is far easier to deal with than a mistake nobody mentions. ### What happens after the scan Training helps, but it can’t catch everything. On a busy day, someone will eventually scan a code. When that happens, what matters is what happens next, and how quickly it’s noticed. A stolen login rarely looks like an attack at first. It looks like a staff member signing in. The early warning signs usually show up on the device and in account activity. That’s why it matters to have protection that watches how devices behave, not just what’s already known to be harmful. We’ve explained how that works in our guide to [endpoint security](https://manux.nz/blog/endpoint-security-what-it-is-why-it-matters-and-how-to-get-it-right), and how round-the-clock monitoring fits in, in our piece on [managed detection and response](https://manux.nz/blog/managed-detection-and-response-what-it-is-and-why-more-businesses-are-moving-to-it). ### How Manux supports your business At Manux Solutions, we help New Zealand businesses deal with both halves of this problem. Through security awareness training, we help your people recognise phishing and social engineering. We also provide and manage endpoint protection and 24/7 managed detection and response as part of our [cybersecurity services](https://manux.nz/services/cybersecurity), with an expert team that investigates and contains threats as they happen. The fake sticker on a parking meter is a warning. The QR code in your inbox is the real risk. ### Take the next step If a QR code slipped past one of your team tomorrow, how quickly would you know? [Get in touch with the Manux Solutions team](https://manux.nz/contact), and we can show you how endpoint protection and managed detection and response catch what happens after the scan. ## RELATED ARTICLES ALL BLOGS [![Manux Logo - Inverted (Expanded)-2](https://manux.nz/hs-fs/hubfs/Logos/Manux%20Logo%20-%20Inverted%20(Expanded)-2.png?width=125&height=31&name=Manux%20Logo%20-%20Inverted%20(Expanded)-2.png)](https://manux.nz/) **OUTCOMES MATTER** Manux Solutions is a dynamic, forward-thinking company committed to delivering high-impact technology and business solutions to organisations seeking transformation and growth. - [OUR APPROACH](https://manux.nz/our-approach) - [SERVICES](https://manux.nz/services) - [Consulting & Strategy](https://manux.nz/services/consulting-strategy) - [Business Transformation](https://manux.nz/services/business-transformation) - [Cloud & Infrastructure](https://manux.nz/services/cloud-infrastructure) - [AI & Automation](https://manux.nz/services/ai-intelligent-automation) - [Business Continuity](https://manux.nz/services/business-continuity) - [Cybersecurity](https://manux.nz/services/cybersecurity) - [Support & Procurement](https://manux.nz/services/support-procurement) - [M-FILES](https://manux.nz/m-files) - INSIGHTS - [Blog](https://manux.nz/blog) - [Case Studies](https://manux.nz/case-studies) - [ABOUT US](https://manux.nz/about-us) - [CONTACT US](https://manux.nz/contact) All rights reserved - [Privacy Policy](https://manux.nz/privacy-policy) - [Legal Disclaimer](https://manux.nz/legal-disclaimer) ```json { "@context" : "http://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "New Zealand", "addressLocality" : "Riccarton", "addressRegion" : "Christchurch", "postalCode" : "8011", "streetAddress" : "3/21 Leslie Hills Drive" }, "email" : "hello@power.com", "knowsLanguage" : "en", "logo" : { "@type" : "ImageObject", "url" : "https://441778586.fs1.hubspotusercontent-ap1.net/hubfs/441778586/Manux%20Logo%20-%20Main%20(Expanded)-1.png" }, "name" : "Manux Solutions", "telephone" : "+49 (0) 89 123 456", "url" : "https://manux.nz/blog/qr-code-scams-have-moved-from-the-car-park-to-the-inbox" } ``` ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "abstract" : "Fake QR codes have spread from parking meters to inboxes. Here’s how QR scams target New Zealand businesses, and the habits that stop them.", "author" : { "@type" : "Person", "name" : "Manux Solutions" }, "dateModified" : "October 28, 2026 6 AM", "datePublished" : "October 28, 2026 6 AM", "headline" : "QR Code Scams Have Moved From the Car Park to the Inbox", "image" : "https://441778586.fs1.hubspotusercontent-ap1.net/hubfs/441778586/yellow-warning-sign-over-a-red-qr-code-on-white-fa-2026-10-02-03-42-48-utc%20%282%29.jpg", "inLanguage" : "en", "keywords" : "[]", "mainEntityOfPage" : { "@type" : "WebPage" }, "name" : "QR Code Scams Have Moved From the Car Park to the Inbox", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://441778586.fs1.hubspotusercontent-ap1.net/hubfs/441778586/Manux%20Logo%20-%20Main%20(Expanded)-1.png" }, "name" : "Manux Solutions" }, "text" : "28 October 2026 In July, Christchurch City Council warned motorists after fake QR code stickers were found on parking machines across the city. Scammers had scribbled over the meter screens with permanent marker, so drivers would scan the sticker instead and land on a fake payment page. (Source: 1News, Christchurch parking meters) It didn’t stay in Christchurch. Wellington City Council removed about a dozen fake stickers from its meters, and Auckland Transport then found scam stickers in its city centre. (Source: RNZ, Scam car park QR codes spreading across NZ) We covered the Christchurch case in our September look at two new security reports. As a Christchurch-based team, it was a story close to home. But there’s a business version of this scam, and it matters more. The sticker on a parking meter is the version you can see. The one aimed at your business arrives in your inbox. Why QR codes get a free pass QR codes are part of everyday life now. We scan them to pay, to order, to sign in and to track a parcel. That familiarity is exactly what makes them useful to attackers. You can hover over a link in an email and check where it goes. You can’t do that with a QR code. You only find out where it leads after you’ve scanned it. ESET’s New Zealand team points out that when a code appears somewhere familiar, like a parking machine or a delivery notice, people are much less likely to question it. (Source: ESET, SecurityBrief NZ) The workplace version At work, the QR code usually arrives in an email or a PDF attachment. It’s often dressed up as a Microsoft security alert asking you to update your multi-factor authentication (Source: Secureworks via Sophos, QR phishing incident), or as an NZ Post notice saying a parcel is held at Customs (Source: RNZ, QR codes latest scam). Scanning it moves the attack from your work computer to your phone, away from the email filtering and security tools that protect your work accounts. The page that opens looks like an ordinary login screen. Whatever you type into it goes straight to the attacker. This is a large-scale problem. Microsoft tracked QR code phishing rising from 7.6 million attacks in January 2026 to 18.7 million in March, a 146% increase over the quarter. By March, 70% of those attacks were hidden in PDF attachments. (Source: Microsoft Threat Intelligence, Q1 2026) It’s a local problem too. ESET reports that QR code scams now make up about one in 10 threats it detects across its New Zealand users, and their share has more than doubled since March. (Source: ESET, New Zealand threat data) Microsoft’s later figures add a detail worth noticing. QR phishing volumes fell after March, but the packaging changed: by June, Word documents carried 40% of QR attacks. (Source: Microsoft Threat Intelligence, Q2 2026) Attackers adjust quickly. Telling staff to watch out for one file type won’t hold up for long. What holds up is a habit. What to tell your team None of this needs technical knowledge. A few simple habits close most of the gap. Treat any QR code in an email or attachment with suspicion, especially one asking you to log in, make a payment or update your security settings. Before you open the link, check the URL preview your phone shows, and don’t open it if it isn’t the site you expected. (See also: NCSC, QR codes: think before you scan) If a request is unexpected, confirm it another way, by calling the sender or going to the website directly instead of using the code. And if something feels off, tell IT straight away, even if you’ve already scanned it. A quick report is far easier to deal with than a mistake nobody mentions. What happens after the scan Training helps, but it can’t catch everything. On a busy day, someone will eventually scan a code. When that happens, what matters is what happens next, and how quickly it’s noticed. A stolen login rarely looks like an attack at first. It looks like a staff member signing in. The early warning signs usually show up on the device and in account activity. That’s why it matters to have protection that watches how devices behave, not just what’s already known to be harmful. We’ve explained how that works in our guide to endpoint security, and how round-the-clock monitoring fits in, in our piece on managed detection and response. How Manux supports your business At Manux Solutions, we help New Zealand businesses deal with both halves of this problem. Through security awareness training, we help your people recognise phishing and social engineering. We also provide and manage endpoint protection and 24/7 managed detection and response as part of our cybersecurity services, with an expert team that investigates and contains threats as they happen. The fake sticker on a parking meter is a warning. The QR code in your inbox is the real risk. Take the next step If a QR code slipped past one of your team tomorrow, how quickly would you know? Get in touch with the Manux Solutions team, and we can show you how endpoint protection and managed detection and response catch what happens after the scan.", "url" : "https://manux.nz/blog/qr-code-scams-have-moved-from-the-car-park-to-the-inbox", "wordCount" : "1294" } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Manux Solutions", "url" : "https://manux.nz/blog/author/manux-solutions" }, "dateModified" : "2026-10-28T06:00:09.489Z", "datePublished" : "2026-10-28T06:00:09.000Z", "headline" : "QR Code Scams Have Moved From the Car Park to the Inbox", "image" : [ "https://manux.nz/hubfs/yellow-warning-sign-over-a-red-qr-code-on-white-fa-2026-10-02-03-42-48-utc%20(2).jpg" ], "mainEntityOfPage" : { "@id" : "https://manux.nz/blog/qr-code-scams-have-moved-from-the-car-park-to-the-inbox", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://manux.nz/hubfs/Manux%20Logo%20-%20Main%20(Expanded)-1.png" } } } ```