Thornaby: Woman targeted in £13k railway station QR code scam

A woman fell victim to fraudsters in a £13,000 railway station QR code scam.

Fraudsters are thought to have covered a genuine code with one of their own in Thornaby Station's car park.

That sent her to a fake website allowing them to redirect payments and card information, resulting in the victim, 71, losing thousands of pounds.

Rail firm TransPennine Express removed all QR codes from its station car parks in September following reports of similar scams across the country.

The incident in Thornaby, north-east England, is one of about 1,200 QR scams investigated by the UK's national fraud reporting centre in just over three years.

In August the victim, who wishes to stay anonymous, used the code and, after a string of fraudulent payments were blocked by her bank, the fraudsters called her posing as bank staff.

Referencing genuine transactions, they convinced her they were legitimate and obtained enough information to run up debts of thousands in her name, including a loan of £7,500 they took out in minutes.

They also set up online banking and changed her address before asking for new cards to be sent out.

After months of a "logistical nightmare", the victim is still waiting for her credit card to be unfrozen.

"It was the first time I'd ever used a QR code and I won't be using one again," she said.

"When the scammer called, he was so convincing and gave me a sense of security by mentioning transactions from my account that I recognised.

"But even while I was on the phone, he was logging into my accounts as me and took out a loan in 20 minutes."

The woman has struggled to trust anyone since.

"I can't believe I fell for it," she said. "I've had so many sleepless nights and spent hours and hours speaking to my bank and credit card company trying to sort it all.

"I was locked out of my accounts. Luckily I had another credit card to survive on, but without that and help from my son, I don't know how I would have coped."

VirginMoney told the BBC the loan had been written off and all fraudulent transactions refunded.

A spokeswoman said the scammers had managed to get away with £4,700 but their other transactions had been blocked.

She said the company had taken steps to protect the woman in the future, including placing enhanced security controls on her accounts.

According to figures exclusively obtained by the BBC, Action Fraud receives hundreds of crime reports every year linked to QR codes.

Action Fraud said more than 400 such offences were logged in the first nine months of 2023, compared with 112 in 2020.

QR stands for "quick response". The black and white squares work like a two dimensional barcode and can be scanned by a phone or tablet.

Businesses often use them to direct people to things such as app downloads, payment platforms, social media accounts, menus and events listings.

Banking trade association UK Finance says:

The woman reported the scam to police and station staff. A spokeswoman for Cleveland Police said they referred her to Action Fraud.

TransPennine Express, which manages Thornaby station, said it has since removed QR codes from payment signs at all of its 14 car parks, covering 1,300 car-parking spaces.

Urging customers to avoid using any QR codes in their car parks, managing director Chris Jackson said: "We acted quickly and thoroughly inspected all our car-park signs.

"No evidence of fraudulent stickers was found and we had not received any reports in our customer relations system or social media contact."

Follow BBC Tees on Facebook, X (formerly Twitter), and Instagram. Send your story ideas to [email protected].