That Parking QR Code May Be a Sticker: Pause Before You Scan

You pull into a parking space, glance at the meter, and see a QR code. Scan, pay, get on with your day. It feels official because the code is attached to something official.

That assumption is exactly what scammers are counting on.

The Federal Trade Commission recently warned that people have reported fake QR codes placed over legitimate codes on parking meters. The replacement code can send you to a convincing imitation payment page designed to collect your card number, login information, or money.

This is a useful scam to discuss with your family because it does not begin with an obviously suspicious phone call. It begins in a real parking space while you are trying to complete a normal task.

What is happening?

A scammer creates a QR code that points to a website they control. They print it as a sticker and place it over, beside, or near the genuine code on a meter or parking sign.

When you scan it, the page may borrow the colors, wording, and layout of a legitimate parking service. It might ask for your license plate and payment information. It may even show a believable confirmation screen.

The danger is not the QR code itself. A QR code is simply a shortcut to a web address. The danger is that you cannot see where the shortcut leads until you scan it, and a hurried person may trust the page before checking the address.

Why this scam works

Parking creates a small but effective pressure chamber. You may be late, unfamiliar with the area, worried about a ticket, or trying to manage children and bags. The code is physically attached to a meter, so your brain treats it as part of the environment instead of as a link supplied by a stranger.

The scam does not need you to be careless. It only needs you to be busy.

That is a pattern worth remembering far beyond parking: when a payment request arrives inside an ordinary task, the setting can make the request feel safer than it really is.

Warning signs to notice

Before scanning, look closely at the code. Does it appear to be a sticker placed over another sticker? Are the corners raised? Does the branding look different from the meter or nearby signs? Is there another payment method printed on the machine?

After scanning, pause on the link preview before opening it. Look for misspellings, extra words, switched letters, or a domain that does not match the named parking company or city.

Once the page opens, be cautious if it asks for more information than a parking payment reasonably requires, pushes you to download an app from outside your phone's official app store, or produces a strange error and asks you to submit payment again.

A polished page is not proof that a page is legitimate.

The 60-second defense

Use this rule: Before paying through a public QR code, verify the payment path another way.

Check the meter or sign for an official app name or typed web address. If one is provided, open the app yourself or type the address into your browser instead of using the QR code. When possible, pay directly at the meter or through an app you already know.

Keep your phone and apps updated. Use unique passwords and multi-factor authentication for important accounts. Those steps will not make every bad link harmless, but they can reduce the damage if a scammer captures information.

Already scanned and paid?

Do not panic, and do not keep interacting with the page.

If you entered a password, change it immediately. Change it anywhere else you reused it, too. Review your card and bank activity, and contact the card issuer or bank using the number on the back of your card if you see an unfamiliar charge or believe your payment information was exposed.

Report the incident to the parking operator or city so the false sticker can be removed. In the United States, you can also report the scam at ReportFraud.ftc.gov.

Talk about it tonight

Ask your family: “If a QR code asks us to pay, how will we verify the website before entering a card number?”

Then choose one simple family rule. It might be, “We inspect the link preview,” “We use the official app,” or “We type the web address ourselves.” The best rule is the one everyone can remember while they are rushed.

Scammers want the payment to feel routine. A ten-second pause breaks that rhythm.

If a message, website, or payment request feels suspicious, paste the message or describe what happened in The Scam Hotline Scam Detector. It is free, and it can help you slow the situation down and choose the next step.

Scammers want silence. Families talk. Talk to yours today.

Sources

• Federal Trade Commission: See a QR code parked somewhere? Don't scan it...yet!
• FTC fraud reporting portal