Fraudsters are targeting “Boris bike” users to get free rides on the cycle network in a scam leaving people hundreds of pounds out of pocket.

Payment dodgers are operating at docks in tourist-friendly areas with a scheme known as “cycle surfing”.

They hover around the payment machines and look at the codes people are given on their receipts to release the Santander Cycles. They then punch in the code at the docks before the legitimate user and cycle off.

The paying customer — confused or thinking there has been an error when they can’t get a bike out themselves —goes to the machine and gets a new code, often none the wiser that they have been scammed.

But they are hit with huge costs when the bikes are used for hours or not returned. Charges of up to £300 are incurred if a bike is damaged or not returned.

Transport for London today issued a warning to people to keep their codes safe and have recently installed CCTV cameras at docks in Hyde Park Corner and South Kensington, where they have seen the most incidents.

Rachel Dickson, 25, was sightseeing in London when she was “cycle surfed” while hiring a bike at Hyde Park Corner. Days later she noticed £94 had come out of her account.

She told the Standard: “I was shocked when I saw how much money had been taken. I spent an hour on the phone with various people from TfL and Action Fraud and was told I’d been cycle surfed.

“It’s beyond belief that people would spend their days loitering by docked bikes to rack up fines in someone else’s name. That is a lot of money to me and is the difference between being able to afford my food shop or car insurance.”

Miss Dickson was later refunded by TfL.

A TfL spokesman said there were 37 confirmed cases last year, but admitted the number could be much higher as some people may not report or realise that they had been scammed. Victims online say they have been charged £300 when “cycle-surfed” bikes taken out under their name are not returned. Code print-outs and stickers on docks carry warnings to users that codes should be treated with the same privacy as card pins.

Police are also working with TfL. In the summer, staff will be on hand at the busiest cycle stations to watch the machines. David Eddington, head of cycle hire at TfL, said: “We are aware of rare incidents of pin surfing ... and are committed to tackling this.” A Met Police spokesman said reported incidents were rare, but added: “The Met is working with TfL and the Royal Parks Agency to tackle this type of offending … we will act if there is specific types of offending at certain locations.”

The scheme works by cyclists paying £2 at a card machine then receiving a code that releases the bike. Users have access for 24 hours but it must be docked every 30 minutes or they will be charged an extra £2 every half-hour.