A fake QR code scam is a sticker with a scammer’s QR code pasted over the real code on a parking meter. Scan it, and you land on a fake payment page built to steal your card number and personal details — while the real meter never gets paid. Before you scan, check the code itself: if it looks like a sticker sitting on top of the meter, pay at the meter or through the city’s official parking app instead.
This trick is called quishing, short for QR-code phishing: phishing delivered through a QR code instead of a clickable link. It works because a QR code hides its web address until you scan it. You cannot read where it leads just by looking at the black-and-white square — and that is exactly what the scammer counts on. On September 3, 2026, the FTC’s September 2026 alert warned that people have reported scammers covering up legit QR codes on parking meters with a QR code of their own, and that scanning one could take you to a fake site designed to steal your money, your personal information, or both.
This is not one city’s problem. In New York, investigators found 64 fake QR code stickers on Manhattan parking meters, all pointing to a lookalike payment page, and a man was indicted over the scheme on September 30, 2026. In Raleigh, North Carolina, the city warned on December 31, 2025 about unauthorized QR codes on downtown meters. In Asheville, the city removed about 20 fraudulent stickers from its meters in February 2026. The pattern is the same everywhere: a cheap sticker, a fake payment page, and a driver in a hurry.
What does a fake QR code scam look like?
A QR code parking scam starts the same way almost every time. You park, walk up to the meter, and see a QR code that says something like “Scan to Pay” or “Scan Here To Pay For Parking.” It looks official. You point your phone at it, and the page that opens looks like the city’s payment page: it asks for your license plate, your phone number, and your card details. You pay, and nothing happens — no confirmation, no receipt, no proof you paid.
That is the first sign something is wrong, and by then the damage is done. The page was never the city’s. The card details you typed in went to the scammer, and because the real meter never received your payment, you can also end up with a parking ticket. One victim told the Better Business Bureau’s Scam Tracker about a $1.98 charge on the day they scanned a parking QR code, followed by a $49.99 charge on their credit card for three months in a row — and having to cancel the card to make it stop.
In New York, the first victim the city heard from had scanned a sticker near 79 East 10th Street in June 2025. The sticker read “Web Pay. Scan to Pay,” and the page it opened carried the official ParkNYC logo and asked for a credit card number, expiration date, phone number, billing address, and license plate number. The driver only realized afterwards that the code was a sticker placed on top of the official ParkNYC sticker on the meter.
Why can’t you tell a fake QR code just by looking?
Because a QR code is a picture of a link, not a link you can read. With a normal web address printed on a sign, you can see a misspelling before you type it. With a QR code, the address stays hidden until your phone reads it — and by the time you see it, you are already one tap away from the fake page.
The FBI made the same point in its January 2022 warning about tampered QR codes: criminals replace legitimate codes, physical and digital, with malicious ones, and a victim scans what they think is a legitimate code but is sent somewhere else. The Bureau also said plainly that QR codes are not malicious in nature — the code itself is harmless. The danger is the website it opens, and what that website asks you to type in.
That is also why a parking meter QR code scam works so well. A meter is outdoors, unattended, and already expects your card. You are standing on a sidewalk, in a hurry, and the code is right there. The scammer only needs a cheap printer and a few minutes alone with the meter.
How do I check a QR code before I scan it?
Do these five checks, in order. They take about ten seconds, and any one of them is a reason to pay another way.
| Step | What to do | What it tells you |
|---|---|---|
| 1. Touch the code | Run a finger over the QR code. Is it a sticker sitting on top of the meter, with a raised edge or a corner that lifts? | A sticker over the printed code is the scam itself. The FBI’s first piece of advice is to check that a code has not been tampered with, such as a sticker placed on top of the original code. |
| 2. Look for a second code | Is there another QR code underneath, beside it, or partly covered by it? | Two competing codes on one meter means one of them does not belong there. |
| 3. Point, don’t tap | Point your camera at the code and wait for the link preview. Read the web address before you tap it. | Most phones show the address first. The FTC’s advice is to check the preview for misspellings or switched letters before you tap. |
| 4. Read the domain | Look at the domain name itself — the part just before .com or .org. Is it your city’s site or a parking app you recognize? | A name that is close but not quite right — an extra word, a swapped letter — is a fake page. A city’s name earlier in the address proves nothing. |
| 5. Pay another way | If anything looks off, do not scan. Pay at the physical meter, or open the city’s official parking app yourself. | You reach the real payment system, not a copy of it. In New York, that means the ParkNYC app or the meter itself — nothing else. |
If your city does not use QR codes for parking at all, then any QR code on a meter is fake by definition. New York’s transport department says its meters do not use QR codes for payment, and Asheville says the same about its meters. Before paying in a city you do not know, check the municipality’s official parking website to see which apps and payment methods it actually uses.
Real parking payment vs fake QR sticker — how to tell them apart
| Sign | Real parking payment | Fake QR sticker |
|---|---|---|
| The code itself | Printed directly on the meter or on official signage, flat and part of the design. | A sticker pasted on top, crooked, peeling at the corners, or sitting over another code. |
| How you pay | At the physical meter, or in the city’s official parking app that you opened yourself. | By scanning the code and typing card details into the page it opens. |
| Proof of payment | A receipt, a confirmation in the app, or a ticket from the meter. | No confirmation at all — and a small charge on your card that you cannot match to anything. |
| What happens next | Your parking time is recorded with the city. | Recurring charges can follow, and the meter still shows you as unpaid, so a ticket can follow too. |
| What the city says | The city’s parking website lists the app and the payment methods it uses. | The city warns that the code is not theirs — as New York, Raleigh, and Asheville all did. |
What should I do if I already scanned one or paid?
Act the same day, in this order. First, call the number on the back of your bank or credit card and tell them what happened — ask them to cancel the card and dispute the charge. Second, if you typed a password into the fake page, change it right away, and change it anywhere else you used the same one. Third, check your bank and card statements for charges you do not recognize, and keep checking for the next few weeks: fake parking payments have a habit of turning into small recurring charges.
Then report it. File a report at ReportFraud.ftc.gov, and if you lost money, report it to the FBI’s Internet Crime Complaint Center at ic3.gov. If the sticker is still on the meter, report the location too — to the city’s parking department or the police — so it can be removed before the next driver scans it. In New York, that means contacting ParkNYC at 1-800-428-4027 or by email at parknyc@flowbirdapp.com.
For the full step-by-step version of what to do after a bad click, read our guide on what to do if you already clicked a link. And do not expect the money to come back on its own — the FBI says law enforcement cannot guarantee the recovery of lost funds after transfer, so the call to your bank is the step that matters most.
Where else do fake QR codes turn up?
Parking meters are the best-known version, but the same sticker trick shows up wherever a QR code is trusted without being checked. The FTC first warned about this in December 2023, when scammers were already sticking fake codes over real ones on meters — and sending codes by text and email with a made-up reason to scan, like a failed delivery or a problem with your account. The Bureau warned in January 2022 that criminals tamper with both digital and physical QR codes, so a code in a message deserves the same suspicion as a sticker on a meter.
Fake codes have also turned up on restaurant tables, on EV chargers, on transit signs, and inside packages you never ordered, where a note asks you to scan a code to find out who sent it or to arrange a return. The Better Business Bureau warned in August 2026 that the same sticker-over-sticker technique was appearing on public transit signs and on delivered packages, not just on parking meters. And the same tap-the-link pressure shows up in messages too, including scam messages on WhatsApp that push you to tap a link before you have time to think.
The test never changes, wherever the code appears. A QR code is a link you cannot read until you scan it — so treat it like any other link from a stranger. If you did not expect it, do not scan it. If the place it leads does not look like the organization you expect, close it. And if a payment is involved, go to the organization yourself, through its own app or its own website, instead of following the code.
Frequently asked questions
Is every QR code on a parking meter fake?
No. Many cities do use QR codes for parking payments, and their codes are printed on the meter or on official signage. The fake ones are stickers pasted on top. The check is the code itself: flat and printed means it belongs there; raised, crooked, or peeling means it was stuck on by someone else. And some cities, like New York and Asheville, do not use QR codes on parking meters at all — there, any code on a meter is fake.
Can a QR code infect my phone just by scanning it?
Scanning a code on its own does not infect your phone or steal your money. The harm comes next, when the page it opens asks for card details, a password, a one-time code, or an app download. That is why the check matters before you tap the previewed link, not after.
What if the code looks printed on the meter, not stuck on?
Then it is probably the city’s own code — but still read the link preview before you tap it. A preview that shows a shortened link hides the real destination, and a misspelling or a swapped letter in the address means the page is fake even if the code looks genuine. When in doubt, pay at the meter or open the city’s official parking app yourself.
I paid through a QR code. How do I know if it was fake?
Three signs: you got no receipt or confirmation; a small charge appeared on your card that you cannot match to a parking payment; or new charges keep appearing in the following weeks. A real payment gives you proof — a receipt, an app confirmation, or a ticket from the meter. If you have none of those, call your bank and check the charge.
I already entered my card details. What do I do now?
Call the number on the back of your card today, tell them it was a scam, and ask them to cancel the card and dispute the charge. If you typed a password, change it right away, everywhere you used it. Then check your statements for the next few weeks, and report the fraud at ReportFraud.ftc.gov and to the FBI’s Internet Crime Complaint Center at ic3.gov.
Do all cities use QR codes for parking payments?
No. Some cities use them, some do not, and the rules change from city to city. New York’s meters do not use QR codes for payment, and Asheville says the same. Before paying in a city you do not know, check the municipality’s official parking website to see which apps and payment methods it actually uses — do not take the sticker’s word for it.
What is quishing?
Quishing is short for QR-code phishing: phishing delivered through a QR code instead of a clickable link. The code hides a web address until you scan it, so it can send you to a fake payment or login page without you seeing where you are going first. It is the same trick as a phishing link in an email or text — only the delivery method is different.
Sources: FTC consumer alert, September 3, 2026, “See a QR code parked somewhere? Don’t scan it…yet!”; FTC consumer alert, December 6, 2023, “Scammers hide harmful links in QR codes to steal your information”; FBI IC3 public-service announcement, January 18, 2022 (I-011822-PSA); NYC DOT parking meter scam advisory, June 6, 2025; Manhattan District Attorney’s Office indictment announcement, September 30, 2026; City of Raleigh warning, December 31, 2025; City of Asheville warning, February 2026; Better Business Bureau Scam Tracker alerts.
