You park, scan the code on the meter, and land on a page that asks for your license plate and card. Nothing about the process seems unusual.
In the parking QR code scam, the sticker may be the only thing that does not belong there.
Overview
A scam sticker can cover the real parking code
The parking QR code scam starts in a physical place but sends the victim into an online payment trap. Criminals place their own printed QR code over or beside the genuine code on a parking meter, sign, kiosk, or payment notice.
The replacement can look official at a glance. It may use matching colors, a parking symbol, a zone label, and instructions such as “scan to pay.” A hurried driver has little reason to suspect that the sticker was added later.
Scanning the code opens a website chosen by the scammer. The page copies the visual language of a municipal or commercial parking portal and asks for details that seem normal for the transaction.
The fake checkout steals more than the parking charge
The form may request a license plate, parking zone, telephone number, email address, card number, expiration date, and security code. It can also ask the visitor to create an account with a password.
A small parking fee keeps the victim focused on completing the task. The criminal can capture the card, charge a different amount, enroll the victim in a hidden recurring plan, or use the same credentials on another service.
The driver may still receive a real parking ticket because no payment reached the actual operator. A fake confirmation screen does not update the legitimate meter or parking session.
The FTC has confirmed reports of swapped codes
In September 2026, the Federal Trade Commission warned that people had reported scammers covering legitimate QR codes on parking meters with their own codes.
The FTC said the fraudulent codes can lead to fake sites designed to steal money, personal information, or both. The agency advised drivers to preview and inspect the destination before opening it.
Warning signs include:
- a sticker looks raised, crooked, newer, or different from the sign beneath it;
- two competing QR codes appear on the same meter;
- the destination does not match the operator named on the sign;
- the domain uses misspellings, extra words, or an unusual ending;
- the page requires an account for a simple one-time payment;
- the displayed fee changes at checkout;
- the form asks for a bank password or authentication code;
- the real meter never shows an active parking session.
Why the Fake Page Feels Like Part of the Meter
QR codes hide their destinations. A printed web address can be read before it is entered, but a square pattern asks the phone to translate first. That removes a useful moment of scrutiny.
The physical location supplies borrowed credibility. A code attached to city property feels more trustworthy than the same link sent in an unsolicited message. The scammer relies on the meter or sign to vouch for a website it does not control.
Parking also creates practical pressure. The driver may be late for an appointment, standing in bad weather, or worried about enforcement. Completing a $3 transaction feels more urgent than studying a domain name.
A polished mobile page is easy to copy. A logo, map pin, timer, and vehicle field can be reproduced without access to the real parking system. The page can even calculate a plausible price from the duration selected.
The safest route is the operator’s official app or a website typed from the permanent sign. If the sign lists a zone number, enter that number inside the independently opened service rather than letting the QR code decide the destination.
How the Parking QR Code Scam Works
Step 1: The criminal creates a convincing payment site
The attacker registers a domain resembling a parking operator, city service, or generic payment provider. The page is designed for a small screen because most victims will arrive through a phone camera.
It may copy public logos, rates, location names, and help text. The page does not need to connect to a parking database; it only needs to look active long enough to collect the form.
Step 2: A malicious code is placed over the genuine one
The criminal prints a QR sticker linked to the fake page and attaches it to a meter, kiosk, sign, or posted instruction. A careful placement can hide the edges of the original code.
Other versions add a second code with words such as “new payment system” or “card reader unavailable.” That gives the fake sticker a reason to exist beside legitimate instructions.
Step 3: The parking location supplies false trust
The driver sees official equipment and assumes every label on it was installed by the operator. The QR scanner opens a preview, but the user may tap through without reading the complete hostname.
A short redirect can make inspection harder. The first address may look like a generic code service, then forward the phone to the phishing site.
Step 4: The page collects vehicle and contact details
The form asks for a parking zone and license plate to imitate a real session. Contact fields may be described as necessary for a receipt or expiration reminder.
These details help the page feel functional and give the criminal information for follow-up phishing. A later message can reference the same plate or location.
Step 5: The fake checkout captures the card
The displayed fee is usually modest. After the card is submitted, the page may claim that verification failed and request another card or one-time code.
The criminal can test the card immediately, store it for later use, or pass it to another fraud operation. The amount charged may have no connection to the parking price shown.
Step 6: A confirmation screen delays discovery
The fake page produces a receipt number and countdown timer. Because no obvious error appears, the driver leaves believing the vehicle is covered.
The legitimate operator has no record of the session. Discovery may come from a parking ticket, bank alert, unfamiliar charge, or inability to find the receipt in the real app.
Step 7: Stolen information supports another scam
An email and password entered on the fake site may be tested against shopping, email, or payment accounts. A saved plate and telephone number can support believable parking-fine messages later.
The victim may also receive a fake refund offer after complaining. A second form asking for banking details does not reverse the first theft.
A Safe QR Scan Still Requires a Domain Check
Most phone cameras show a preview of the destination. Pause there. Read the entire registered domain, not just the path containing the city or parking company name.
Letters can be swapped, repeated, or replaced with similar characters. A subdomain can begin with the right name while the actual registered domain at the end belongs to someone else.
If the destination is shortened or unreadable, do not continue. Search for the operator named on the permanent sign, but avoid sponsored results when possible. An official city parking page should identify its approved payment providers.
Inspect the code itself. A sticker edge, air bubble, color mismatch, or layered label is enough reason to use another method. Photograph the suspected tampering and notify the operator so other drivers are protected.
Drivers should also be cautious with QR codes printed on loose paper placed under a windshield wiper. A fake parking warning can claim that a fine must be paid immediately and route the same card-stealing form through a more personal-looking notice.
Rental vehicles create extra pressure because visitors may not know the local parking provider. Check the rental agreement, city website, or permanent meter instructions rather than trusting a sticker simply because the vehicle is away from home.
Businesses that manage parking should inspect codes regularly and use tamper-resistant labels where possible. A published list of official domains gives customers something concrete to compare against the preview shown by their phones.
If a meter offers both a card reader and a QR code, a broken-reader message attached as a new sticker deserves particular scrutiny. Criminals often create a reason for the driver to abandon the more familiar payment route.
Report even an unsuccessful attempt so the malicious sticker can be removed quickly.
Company, Address, and Fulfillment Checks
The operator must match the permanent sign
Read the company or agency name printed as part of the meter or sign, not only on the QR sticker. Look up that operator independently and confirm which apps and domains it accepts.
A generic “City Parking” header on a web page does not identify the business receiving the card details.
The zone and rate must agree
Enter the zone number in the official app or compare the rate with permanent posted information. A fake site may accept any number and still display a payment screen.
If the amount, maximum stay, or enforcement hours differ, stop. Do not let a countdown pressure you into resolving the mismatch on the suspicious page.
The payment descriptor should be recognizable
Before confirming, the checkout should clearly identify the operator or its disclosed processor. An unrelated merchant name, overseas company, or vague subscription label does not fit a local parking session.
After payment, check the bank authorization amount and descriptor. Contact the issuer immediately if either differs from what you approved.
The real system must show an active session
A valid session should appear in the official app, meter, or operator account with the correct plate, zone, and expiration time. A screenshot or receipt generated by the scanned site is not independent evidence.
If you cannot verify the session, use another official method and report the suspect code. Keep both receipts if you had to pay again.
What to Do if You Have Fallen Victim to This Scam
- Stop using the page. Do not retry the payment, enter another card, or contact support through the suspicious site.
- Call the card issuer immediately. Explain that the card was entered into a fake parking QR site. Freeze or replace it and dispute unauthorized charges.
- Check whether a recurring payment was created. Ask the issuer about merchant tokens, subscriptions, and pending authorizations, not only completed transactions.
- Change exposed passwords. If the page made you create an account, replace that password everywhere it was reused and enable multifactor authentication.
- Verify your parking session. Contact the real operator through its published website or app. A fraudulent payment may leave the vehicle unpaid.
- Report the tampered code. Send the meter or sign location, photographs, time, and fake URL to the parking operator, property owner, or city.
- Preserve evidence. Save the QR destination, screenshots, browser history, receipt, bank authorization, and photographs showing how the sticker was placed.
- Report the fraud. File at ReportFraud.ftc.gov in the US and notify local police if card theft or physical tampering occurred.
- Watch for follow-up messages. Treat parking-fine, refund, and card-verification messages that reference the incident as suspicious until independently confirmed.
- Scan the device when appropriate. If the site made you download a file, app, or configuration profile, disconnect and run a Malwarebytes scan. A normal QR scan alone does not usually install malware.
- Add malicious-site blocking. AdGuard can help stop known phishing domains, but a newly registered fake page may not be classified yet. Always inspect the domain.
- Do not pay a recovery service. Work with the bank and legitimate operator. No investigator needs an upfront payment to trace a parking charge.
Frequently Asked Questions
Can a QR code open a site without showing the address?
Many scanners display a preview, but interfaces vary. If you cannot inspect the full destination, use the operator’s official app or type its address yourself.
Does scanning the code alone steal my card?
Usually the theft occurs after information is entered or a malicious file is installed. Close the page, update the phone, and monitor accounts if you only opened it.
What if the QR sticker looks professionally printed?
Print quality proves nothing. Compare it with permanent signage, look for layering, and verify the destination against the operator’s published domains.
Why would scammers target a small parking payment?
The small fee lowers suspicion while the form captures a reusable card and personal details. The later theft can be much larger than the displayed charge.
Will a fake payment protect me from a parking ticket?
No. The legitimate operator may have no record of it. Verify the session and explain the fraud promptly if enforcement action occurs.
Should I scan another code on the same meter?
Not until the operator confirms which code is genuine. Use an official app, payment machine, telephone service, or a website taken from a trusted source.
The Bottom Line
The parking QR code scam borrows trust from a real meter and directs the payment to a fake website. The page can steal a card while leaving the vehicle without a valid parking session.
Inspect the physical label, preview the full domain, and open the operator’s official service independently. A convenient scan should never be the only proof that a payment page is real.
