Payments and parking

The problem

An unattended payment point is a sign with a code on it. The customer trusts the sign because it is bolted to the machine, and the code because it is on the sign. Neither trust is earned by anything technical.

That is why the attack works. A criminal covers the genuine code with a sticker carrying their own, and drivers who scan it reach a cloned payment page under the attacker’s control. The machine looks untouched. The operator finds out when the complaints arrive.

This is not speculative. The US Federal Trade Commission has warned of reports of scammers “covering up QR codes on parking meters with a QR code of their own”. BBC News reported that Action Fraud received 1,386 reports of QR code scams in 2024 against 100 in 2019, with organised crime groups behind the rise, and that contactless payment hotspots such as parking meters are a common target.

How VCode is deployed

Each payment point carries its own VCode, issued by the platform and tied to that specific location. Because generation is closed-loop, an attacker cannot manufacture a code that the platform will recognise. Because the symbol contains no destination, there is nothing in the image for an attacker to rewrite into a substitute.

Rules are attached per location: a geofence so the code only resolves at the site it belongs to, and time windows where tariffs or access hours vary.

What happens when it is scanned

A genuine code resolves through the platform, which confirms which payment point this is and hands the customer the correct payment flow for that location.

A counterfeit stuck over the top does something more useful than failing quietly: it fails to resolve at all, and the attempt is recorded. The customer sees a refusal rather than a convincing clone of your payment page, and the operator sees that somebody attempted a substitution at that site, which is a security event with a time and a place attached.

Why a QR code or NFC alone is not enough

A QR code cannot defend itself here, because the sticker is the attack and the code carries the destination. A dynamic QR code does not help either: the criminal’s sticker carries their URL, not yours, so your ability to change where your own code points is irrelevant to the substitution.

NFC is a genuinely strong answer at a payment point. A cryptographically authenticated tag is hard to clone, and tamper-evident constructions exist. The trade-offs are cost and estate: every point needs hardware, hardware fails outdoors, and a tag can be physically covered or replaced just as a sticker can. NFC also asks the customer to tap a specific spot, which is harder to find on a machine than a sign is to read.

To be precise about what VCode does and does not do here: anyone can still physically cover your code with a sticker, and no technology prevents that. What changes is that the substitute cannot resolve to a destination of the attacker’s choosing. The scan fails instead of quietly taking the customer’s card details, which is the difference between a nuisance and a fraud.

Why it reads in the field

Signage is read from where the customer is standing, not from where it would be convenient. At an appropriate print size the symbology reads at over 100 metres, and at up to 170 degrees against roughly 40 for a QR code.

For an operator that means a code on a machine, a wall or a gantry works from a queue, from a car, or at an angle, without the customer walking up to square themselves to it.

What it changes commercially

• Substitution stops paying. An attack that produces a failed scan and an alert is not worth the criminal’s time.
• You find out from the system, not the customer. Failed resolutions cluster by site, so a targeted car park is visible early.
• The estate becomes addressable. Each point is individually identified, so tariffs, closures and access hours change centrally without visiting the sign.
• Complaints get evidence. Every scan attempt at that location is recorded.

Integration

Codes are minted per payment point through the platform API and can be printed or produced as signage at the sizes the site needs. Resolution runs through the VCode app or through your own application using the SDK, which is the route most operators take so the customer stays inside the operator’s payment experience. Scan history gives per-site reporting. See the developer documentation.