You park, find the payment instructions, and scan the QR code on the meter. The page knows you are paying for parking, asks for your plate and card, and looks ordinary enough to finish quickly.
The square sticker may have been placed there by someone who has nothing to do with the city or parking operator.
Overview
Criminals cover real parking instructions with fake QR codes
A parking QR code scam begins when someone attaches a fraudulent sticker to a meter, payment kiosk, garage sign, or ticket machine. Scanning it opens a website controlled by the scammer rather than the official parking service.
The page copies municipal or parking-app branding and asks for a zone, plate number, parking duration, and payment card. The amount may be small so the driver completes it without examining the domain.
The parking session is not paid. The victim can lose card details, personal information, and account credentials while also receiving a legitimate parking citation.
The physical location gives the sticker borrowed credibility
People trust a code attached to an official machine more than a link in an email. A neatly printed sticker can look like a maintenance update or new contactless option.
Warning signs include:
- A QR sticker placed over another label
- Peeling edges, mismatched colors, or poor alignment
- A payment domain unrelated to the posted operator
- A page asking for excessive personal information
- A small “verification” charge followed by another request
- No confirmation in the official parking app
- A meter that lists a different payment method or zone
The page may steal more than one parking payment
Some fake sites charge the visible parking amount and keep the card data. Others enrol the victim in a recurring subscription or request bank credentials through a false security check.
A second page may ask for a one-time code, allowing an online purchase or digital-wallet enrollment. Downloads and permission requests can introduce additional risk.
Do not scan another nearby code to compare. Several meters in the same area may have been tampered with.
Why QR Codes Hide the Destination
A printed web address lets a driver notice spelling before visiting. A QR code hides the full destination inside a pattern, so the first visible information may be the fake page itself.
Modern phones usually preview the domain before opening it, but small text and time pressure make that warning easy to miss. A domain can also shorten or redirect to another address.
The padlock icon means the connection is encrypted. Criminal sites can use HTTPS too, so the padlock does not verify the parking operator.
The Federal Trade Commission has warned that scammers cover parking-meter QR codes with their own and send users to spoofed sites designed to steal information.
How the Parking QR Code Scam Works
Step 1: A fake sticker is placed on official equipment
The criminal prints a QR code with payment language and attaches it to a meter or sign. The design may imitate the real operator or simply say “scan to pay.”
Locations with many visitors, poor lighting, busy enforcement, or several payment systems create confusion the sticker can exploit.
Step 2: The driver scans while focused on avoiding a ticket
Parking is usually a quick task performed outdoors and under time pressure. The driver wants to leave the car legally rather than investigate a website.
The phone opens a domain chosen by the sticker maker. Nothing about the camera scan confirms that the code belongs to the machine.
Step 3: A cloned page requests normal parking details
The site asks for the license plate, zone, duration, and card. These expected fields make the page feel functional.
Logos, maps, location detection, and a realistic price can be copied or generated automatically. The site may even display a fabricated receipt.
Step 4: Card data and identity information are captured
When the form is submitted, the criminal receives the card number, expiration date, security code, name, telephone number, email, and vehicle information.
The page may report an error and request another card, allowing several payment methods to be stolen from one victim.
Step 5: A one-time code authorizes a larger action
The fraudster attempts a purchase or card enrollment, triggering a genuine bank code. The fake parking page asks the driver to enter it to complete payment.
The code may approve something unrelated to parking. Read the bank message carefully and stop if the merchant or amount does not match.
Step 6: The victim receives a fake confirmation
A receipt screen, email, or countdown claims the session is active. Because the official parking system received nothing, enforcement may still issue a citation.
The driver often discovers the scam only after seeing unauthorized card activity or learning that the parking was never paid.
Step 7: Stolen details support later phishing
The criminals know the victim recently parked in a specific city and may send a believable unpaid-ticket message. Vehicle and contact details help personalize the follow-up.
Card data can be tested with small charges before larger purchases. Monitor the account even if the attempted parking charge was declined.
How to Pay for Parking Safely
Use coins, a payment card directly at the meter, or an official app that you installed from the phone’s app store after confirming the operator’s name. Do not install an app from the QR destination.
Type the parking company’s known address or use the city’s official website to locate payment options. Compare the zone number on several permanent signs.
Inspect the QR label before scanning. Look for a sticker covering another code, residue, bubbles, different print quality, or instructions that conflict with the machine.
If anything looks altered, photograph it from a safe position and report the meter. Move to another verified payment method rather than testing the suspicious page.
What to Check Before Entering a Card
Read the entire domain, not just the first familiar word. Search for the parking operator independently and compare its official payment address.
Confirm the zone, price, city, and operator. A generic page that cannot identify the location without collecting extensive data deserves caution.
Review the requested information. Parking normally does not require a banking password, Social Security number, account recovery phrase, or software installation.
Use a credit card or wallet with transaction alerts when available. Alerts do not make a fake site safe, but they can reveal misuse quickly.
Company, Address, and Fulfillment Checks
The operator name should match permanent signage
Compare the meter, street sign, garage entrance, city website, and app listing. A sticker alone should not define the operator.
The web address must match official records
Reach the site from the municipality or parking company rather than the code. Lookalike domains can use convincing logos.
The zone and payment should appear in the official system
A real session normally appears in the official app or receipt system. A page controlled by the scammer cannot update enforcement records.
The receipt needs verifiable transaction details
Check the merchant name, time, zone, plate, amount, and support channel. A generic confirmation image is not proof of payment.
What to Do if the Code Looks Tampered With
Do not peel the sticker if doing so creates risk or destroys evidence. Photograph the code, the full meter, nearby signs, location, and any visible layering.
Notify parking enforcement, the city, garage staff, or the operator using independently found details. Provide the meter number and exact location.
Warn nearby drivers without scanning the code yourself. If possible, use an official app or another machine confirmed by staff.
Do not assume only one meter is affected. Criminals can place many stickers during a short visit.
Other Places Fake Payment QR Codes Appear
Fraudulent codes can be placed in garages, at electric-vehicle chargers, on restaurant bills, vending machines, bicycle rentals, transit signs, donation posters, and public notices.
A sticker may cover a genuine code or sit beside it as a supposed alternative. The surrounding equipment can be real even when the added payment route is not.
Codes also arrive by email and text with claims about unpaid tickets or expired parking. Those messages can target people whose vehicle details were collected by an earlier fake page.
A mailed parking notice may include a QR code leading to a cloned city portal. Verify citations using the authority’s independently located website and reference process.
Businesses should inspect public payment equipment regularly and train staff to recognize layered labels. Removing one code without checking nearby signs may leave the campaign active.
How to Understand the Bank Alert
A small authorization can be a test rather than the full theft. Lock the card and contact the issuer instead of waiting for a larger transaction.
The merchant name may not mention parking. Criminal processors, shell companies, and payment intermediaries can produce unfamiliar descriptions.
If a one-time code names a different merchant or amount, do not enter it. The code is authorizing that stated transaction, not validating the parking page.
A declined charge does not mean the details are safe. The card number and personal information may already have been captured for later use.
Ask the issuer whether a digital wallet, recurring payment, or card-on-file token was created. Canceling one visible charge may not remove continuing authorization.
What Parking Operators Should Do
Use tamper-evident labels, consistent branding, and clear official domains. Provide a telephone or app alternative that drivers can verify without scanning.
Inspect high-traffic equipment and keep a record of legitimate code placement. Staff should photograph tampering before authorized removal and preserve the sticker when police request it.
Publish alerts that identify affected locations without linking to the malicious site. Tell customers how legitimate receipts and merchant descriptors should appear.
Coordinate with payment processors, domain registrars, hosting providers, and law enforcement to disable the fraud infrastructure quickly.
How to Help Someone Who Used the Fake Code
Ask the person to stop entering information and close the page. Do not shame the quick decision; the sticker was placed specifically to exploit a routine task.
Help identify which fields were submitted, whether a code was approved, and whether an app or profile was installed. The recovery steps depend on what left the device.
Call the card issuer using the number on the card, not any support number shown by the page. Request a replacement when card details were exposed.
Check the official parking system so the vehicle can be paid or moved. Avoid a second citation while handling the fraud report.
Photograph the tampering and notify the operator so other drivers are protected. A clear location and meter identifier are more useful than repeatedly scanning the malicious code.
Check nearby bank alerts for the next several days, because stolen card details may not be tested immediately.
What to Do if You Have Fallen Victim to This Scam
- Contact the card issuer immediately. Explain that card details were entered on a fraudulent parking page and request replacement, monitoring, and disputes.
- Review and lock the card. Check pending and posted activity, including small unfamiliar charges that may be tests.
- Change exposed passwords. If the page requested a login, secure email and financial accounts from a trusted device and enable strong two-factor authentication.
- Save the evidence. Record the URL, redirect chain, screenshots, meter number, location, receipt, charges, and time.
- Report the tampered meter. Contact the city or parking operator and local police when physical equipment was altered.
- Scan the phone if anything downloaded. Remove unknown apps or profiles and run Malwarebytes to check for malicious or unwanted software.
- Block dangerous pages. AdGuard can help stop known phishing domains and malicious redirects, but the compromised card still needs replacement.
- Resolve the parking session separately. Pay through an official method and keep evidence when disputing a citation caused by the fake code.
- Report online fraud. Submit the site at ReportFraud.ftc.gov and to the hosting, browser, or payment provider when identifiable.
Is Your Device Infected? Run a Free Malware Scan
Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.
The free version detects and removes the most common threats, including:
- Adware — the cause of those annoying pop-ups
- Browser hijackers — unwanted redirects and changed homepages
- Trojans and spyware — hidden programs stealing your data
- Potentially unwanted programs (PUPs) — software you never asked for
👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.
Run a Malware Scan with Malwarebytes for Windows
Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.
Download Malwarebytes
Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.
Download MalwarebytesOfficial installer for Windows 11 and 10. Your download starts right away.Want real-time protection? See Malwarebytes Premium
Malwarebytes Free for WindowsScans and removes malware at no cost-
Install Malwarebytes
When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.
Follow the On-Screen Prompts to Install Malwarebytes
The setup wizard will walk you through a few quick screens:
-
Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.
-
Malwarebytes will now install on your device. This usually takes under a minute.
-
When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.
-
On the final screen, click Open Malwarebytes to launch the program.
-
Enable “Scan for Rootkits”
Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.
In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.
Done? Click “Dashboard” in the left pane to return to the main screen.
Start the Scan
Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.
-
Wait for the Scan to Finish
The scan checks your entire system for browser hijackers and other malicious programs, so it can take 5 to 20 minutes depending on your computer. Feel free to do something else — just check back occasionally to see the progress.
-
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.
Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.
-
Restart Your Computer
Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, Malwarebytes has finished removing the threats it found.
That’s it — your Windows PC is now clean of trojans, adware, and other malware, and should be back to running smoothly.
If you are still having problems with your computer after completing these instructions, then please follow one of the steps:
- Run a computer scan with ESET Online Scanner
- Ask for help in our Windows Malware Removal Help & Support forum.
Run a Malware Scan with Malwarebytes for Mac
Malwarebytes for Mac is a free on-demand scanner that removes the malware other security software tends to miss — adware, browser hijackers, and unwanted programs included. Cleaning an infected Mac with Malwarebytes has always been completely free, and it’s our go-to recommendation. Follow the steps below to scan and clean your Mac in just a few minutes.
-
Download Malwarebytes for Mac
Click the button below to download the latest version of Malwarebytes for Mac.
Download MalwarebytesOfficial installer for macOS. Your download starts right away.Want real-time protection? See Malwarebytes PremiumMalwarebytes Free for MacScans and removes malware at no cost -
Open the Malwarebytes setup file
When the download finishes, open your Downloads folder and double-click the setup file to begin the installation.
-
Follow the On-Screen Prompts to Install Malwarebytes
The Malwarebytes for Mac Installer will guide you through a few quick screens. Click “Continue” and keep following the prompts until the installation completes.
When the installation is complete, Malwarebytes opens to the Welcome to Malwarebytes screen. Click “Get started“.
-
Select “Personal Computer” or “Work Computer”
Malwarebytes will ask what type of computer you’re installing it on. Click either Personal Computer or Work Computer, whichever applies.
-
Start the Scan
Click the “Scan” button. Malwarebytes will automatically update its detection database and begin checking your Mac for malware.
-
Wait for the Scan to Finish
Malwarebytes will scan your Mac for adware, browser hijackers, and other malicious programs. This can take a few minutes, so feel free to do something else — just check back occasionally to see the progress.
-
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found. Click the “Quarantine” button to remove all the threats at once.
-
Restart Your Mac
Malwarebytes will now remove all the malicious files it found. Some threats can only be fully removed after a reboot — if Malwarebytes asks you to restart, allow it. Once you’re logged back in, your Mac is clean.
That’s it — your Mac is now free of adware, rogue browser extensions, and other potentially harmful software.
If you are still experiencing problems while trying to remove a malicious program from your computer, please ask for help in our Mac Malware Removal Help & Support forum.
Run a Malware Scan with Malwarebytes for Android
Malwarebytes for Android automatically detects and removes dangerous threats like malware and ransomware so you don’t have to worry about your most-used device being compromised. Aggressive detection of adware and potentially unwanted programs keeps your Android phone or tablet running smooth.
-
Download Malwarebytes for Android.
You can download Malwarebytes for Android by clicking the link below.
Get Malwarebytes for AndroidOpens Google Play in a new tab.Want real-time protection? See Malwarebytes Premium for AndroidMalwarebytes for AndroidScans your phone and removes malware at no cost -
Install Malwarebytes for Android on your phone.
In the Google Play Store, tap “Install” to install Malwarebytes for Android on your device.
When the installation process has finished, tap “Open” to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.
-
Follow the on-screen prompts to complete the setup process
When Malwarebytes will open, you will see the Malwarebytes Setup Wizard which will guide you through a series of permissions and other setup options.
This is the first of two screens that explain the difference between the Premium and Free versions. Swipe this screen to continue.
Tap on “Got it” to proceed to the next step.
Malwarebytes for Android will now ask for a set of permissions that are required to scan your device and protect it from malware. Tap on “Give permission” to continue.
Tap on “Allow” to permit Malwarebytes to access the files on your phone.
-
Update database and run a scan with Malwarebytes for Android
You will now be prompted to update the Malwarebytes database and run a full system scan.
Click on “Update database” to update the Malwarebytes for Android definitions to the latest version, then click on “Run full scan” to perform a system scan.
-
Wait for the Malwarebytes scan to complete.
Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
-
Click on “Remove Selected”.
When the scan has been completed, you will be presented with a screen showing the malware infections that Malwarebytes for Android has detected. To remove the malicious apps that Malwarebytes has found, tap on the “Remove Selected” button.
-
Restart your phone.
Malwarebytes for Android will now remove all the malicious apps that it has found. To complete the malware removal process, Malwarebytes may ask you to restart your device.
That’s it — your Android phone is now clean — no more malicious apps, adware, or browser redirects.
If you are still having problems with your phone after completing these instructions, then please follow one of the steps:
- Restore your phone to factory settings by going to Settings > General management > Reset > Factory data reset.
- Ask for help in our Mobile Malware Removal Help & Support forum.
Stay Protected: Block Ads and Malicious Sites
Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.
We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.
👉 Download AdGuard and browse safely
Frequently Asked Questions
Are QR codes on parking meters always fake?
No. Many operators use them legitimately. Verify the physical label, domain, operator, and payment method before entering information.
Does a padlock make the parking page safe?
No. It only shows that the connection is encrypted. A phishing site can also have HTTPS.
What if the page charged the correct parking amount?
The site may still retain card details, and the official session may not exist. Contact the operator and card issuer.
Should I remove a suspicious sticker?
Photograph and report it first. Let authorized staff or police preserve and remove physical evidence safely.
Can a fake QR code install malware automatically?
Opening a page does not always install malware, but downloads, apps, profiles, and permission requests increase risk. Scan if anything was installed.
Can I dispute a ticket caused by the fake code?
Contact the parking authority and provide photographs, the fraudulent receipt, bank record, report number, and timeline. Its appeal rules determine the result.
The Bottom Line
A parking QR code scam hides a phishing link on trusted physical equipment. The fake page can steal card details while leaving the vehicle unpaid.
Inspect the sticker, verify the operator independently, and use the official app or another payment method whenever the code or destination looks wrong.
Join the discussion
0 commentsShare your experience or ask a question about this article.
Discussion
Start the conversation
Have a question or something useful to share? Add the first comment.