QRTrust Logo
You scan. We protect.
Back to blog
Security

Quishing Reaches the Benelux: Fake QR Codes in The Hague, Ieper and Noord-Limburg

6 min read

Alberto Stegeman warns about QR code fraud on Dutch television – and four new incidents in the Netherlands and Belgium show the scam has long since crossed borders. Our quishing map now covers three countries.

Quishing has reached prime-time television in the Netherlands

On 20 July 2026, the Dutch consumer show "MAX vakantieman" (Omroep MAX) covered the scams that target travellers abroad. Its guest: Alberto Stegeman, arguably the best-known investigative journalist in the Netherlands. One of the three scams he warns about: fake QR codes on parking machines.

His point is short and correct: as soon as you scan the code, you are asked to enter your details – often including your password. The programme also warned about fake Wi-Fi networks (the classic example: "Fee Wifi Airport" instead of "Free Wifi") and about fake toll bills from France, where physical toll booths are gradually disappearing.

Why this is more than a holiday warning

When a public broadcaster warns about quishing in prime time, the topic has reached the mass audience. And the scam does not wait at your holiday destination – it is already on your own doorstep.

Four documented cases in the Netherlands and Belgium

We have expanded our quishing map beyond Germany for the first time. Four new incidents from the Netherlands and Belgium are now documented – all from recent weeks:

LocationDateWhat happened
Den Haag (Scheveningen)15.06.2026City warns of stickers on parking machines – and uses no QR codes itself
Ieper (BE)24.06.2026Fake site demanded 10 euros for a parking ticket; a warden removed the stickers
Oostende (BE)24.06.2026Parallel case at a single parking machine
Noord-Limburg (BE)19.05.2026Six municipalities affected – parking machines, restaurant terraces and posters

The Hague rule of thumb: when every QR code is a forgery

The Hague case offers the most practical rule of thumb of this entire fraud wave. The municipality made it clear: it does not use QR codes for parking at all. Payment happens only at the machine – by card or contactless. Any QR code stuck there is therefore a forgery by definition. No checking needed, no URL analysis: code spotted, fraud identified.

It is worth checking this for your own town: does the local operator use QR codes at all? If not, you have a rule that works without any thinking.

New: the scam is leaving the car park

The warning from Politiezone Noord-Limburg is the most revealing of the four. It covers six municipalities – Pelt, Hamont-Achel, Hechtel-Eksel, Leopoldsburg, Lommel and Peer – and names two locations besides parking machines that were barely on the radar: restaurant terraces and posters.

The QR code on your restaurant table that opens the menu can be covered by a sticker just as easily as the one on a parking machine. It is simply the one nobody inspects.

The same scam, a different border

What is happening in Ieper and The Hague is exactly the pattern we documented weeks earlier in Dorsten and Frankfurt: QR codes covered with stickers, a cloned payment page, harvested card data. The perpetrators know no national borders – official warnings do.

That is precisely why we maintain the quishing map: a single incident in Dorsten tells you little if you are parking in Scheveningen. But 36 incidents across three countries reveal a pattern – and make clear this is not a local glitch but an organised, travelling form of fraud.

How to protect yourself

  • • Feel the code – a sticker has a noticeable edge.
  • • Find out whether your town uses QR codes for parking at all. Often the answer is no.
  • • Use the official app from the app store instead of the code on the machine.
  • • Ignore shortened or unusual URLs – Belgian police name this explicitly as a warning sign.
  • • Already scanned and entered your details? Block your card immediately and report it.

The quishing map now covers three countries

36 documented incidents across Germany, the Netherlands and Belgium – with location, date, method and source. Every entry is tied to verifiable reporting from police, municipalities or the press.

And if you do have to scan: QRTrust checks the destination in real time against multiple phishing databases and AI models before the page even opens.

View the quishing map →

Sources

*About QRTrust: QRTrust is Germany’s first QR code security platform, developed in Dortmund. With AI-powered real-time detection, QRTrust protects citizens and businesses from quishing attacks. 100% GDPR compliant, hosted in Germany.*

Back to blog