Is that parking QR code a scam?

If you hesitate before scanning a QR code in a car park, that hesitation is earned.

Over the last couple of years, UK drivers have been warned about quishing: fake QR codes stuck on ticket machines, pay-and-display signs, and parking posts. The code looks official. It opens a site that looks like a parking app. It asks for card details. Reporting from the Bureau of Investigative Journalism found councils and hospital car parks across the country had been targeted.

That is a payment scam. It lives on infrastructure — machines and signs you expect to take money.

A move-request sticker lives on a vehicle. It should never ask you to pay. If it does, stop.

Two QR codes that are not the same thing

Payment QR. On a machine or a pole. Purpose: take money for a stay. Risk: a sticker placed over the real code, leading to a lookalike site. Advice from police and parking bodies is consistent: check the URL, prefer the official app, do not pay through a code that looks taped on.

Move-request QR. On a windscreen or side window. Purpose: tell the driver or a workplace contact that the car needs to move. There is no stay to pay for. There is no fine to settle. There is no account to create.

If you mix those two up, you will either scan something dangerous or refuse something harmless. The job is to tell them apart in five seconds.

What a genuine move-request scan looks like

You are blocked in. You look at the car in front. There is a small printed sticker, usually with a sentence like “Am I blocking you?”, a QR, and a registration.

You open the camera. Before you tap the notification, read the link preview.

For EMSHI it should be an emshi.app address — not a random short link, not a page that jumps to a bank, not a PDF, not an App Store listing that you did not ask for.

The page should show the vehicle registration so you can match it to the plate. Then a single action: notify the person who can move it. No card form. No “unlock with Apple Pay.” No password. No “download to continue.”

If the blocked driver must install something, the product has already failed. People who are late do not install apps for strangers.

Red flags — close the tab

Walk away from the scan if you see any of these:

• A request for payment, a “PCN,” or a card number.
• A login wall before you can say you are blocked.
• A URL that is not the brand you can read on the sticker, or a tiny letter-swap (emshl.app, extra hyphens, a different domain with “emshi” in the path).
• A sticker obviously slapped over another sticker, or sitting on a ticket machine rather than on a car.
• Pressure copy: “Pay in 3 minutes or get towed.” A move request can be urgent without being a ransom.

Trust the camera preview more than the artwork. Scammers print nice stickers too.

What EMSHI never asks a scanner for

EMSHI is built so the blocked person stays anonymous. You confirm the car. You tap. The platform sends the nudge. You do not type your phone number to make the request happen.

Driver mode can offer an optional number later, only for status texts about that one request, and it is not shown to the other driver. If a page demands your number up front “to verify you are human,” that is not this product.

You should also never see the owner’s mobile. If a scan dumps a phone number or a WhatsApp chat onto the screen, you are not in a private move-request flow — you are in the old dashboard-note model with extra steps.

If you are the person putting a sticker on the car

You have a trust job. The blocked driver has been trained by headlines to treat car-park QR codes as hostile.

Make the sticker look like a sticker on a car, not like a payment sign. Keep the sentence human. Print from the real product so the code points at emshi.app. Do not laminate a screenshot of a random QR generator and hope.

If you want the private version rather than a number on the dash, print a Driver sticker. If you run the car park, issue staff stickers so visitors scan a workplace code, not a personal WhatsApp.

The scam stories are about people trying to pay through a code on a machine. A windscreen code that only asks to move a car, shows the plate, and never takes money is a different object. Check the URL. If it asks for a card, it is not a move request.