QR Code Parking Scams: How to Check Before You Scan in 2026
QR code parking scams are simple, cheap, and nasty. A scammer prints a sticker, places it over a real parking payment code, and waits for drivers to scan it. The page can look like a city payment portal or a real parking app, but the money and card details go to the wrong place.
The Federal Trade Commission has warned that scammers cover legitimate QR codes on parking meters with their own codes. The Better Business Bureau has also warned about fake codes on parking lots, public transit signs, packages, and other public surfaces.
The rule is simple: treat public QR codes like links in suspicious emails. They may be useful, but they deserve verification before you enter payment information.
How the scam works
Most parking QR scams follow this pattern:
- The scammer places a fake QR sticker on a meter, kiosk, sign, or payment notice.
- The fake code sends your phone to a lookalike payment site.
- The page asks for your license plate, phone number, email, card number, or account login.
- You think you paid for parking.
- Later, you may get a real parking ticket, unauthorized charges, or both.
The trick works because parking is a rushed moment. You are standing outside, traffic is moving, the meter is counting down, and the QR code feels official because it is physically attached to the meter.
That is exactly the pressure scammers rely on.
Red flags on the meter or sign
Before you scan, look closely at the code itself.
Be suspicious if:
- The QR code is a sticker placed over another sticker
- The code looks crooked, bubbled, freshly placed, or easy to peel
- The payment instructions mention a different app than the official city or lot signs
- The URL preview looks unrelated to the city, airport, venue, or parking company
- The page asks you to create an account before showing clear parking details
- The meter has multiple competing QR codes
- The payment page has spelling errors, odd logos, or a strange checkout flow
A public QR code should not feel like a mystery. If you cannot tell who owns the payment page, do not enter your card.
Check the URL before paying
Most phones show a link preview before opening a QR code. Slow down and read it.
Look for:
- The official city domain
- The official parking operator domain
- A known parking app domain you already use
- HTTPS, spelled correctly
- A payment flow that matches the meter zone, plate number, and location
Watch for:
- Misspelled domains
- Extra words before the real brand name
- Short links
- Random numbers and letters
- Domains ending in unfamiliar country codes
- A site that asks for unrelated information
Scammers love domains that look official at a glance. cityparking-pay.com is not the same as an official city website. parkmobile-payments.example is not the same as the real ParkMobile domain.
The safer way to pay for parking
The safest move is to avoid the QR code when you can.
Use one of these instead:
- Open the parking app already installed on your phone
- Type the official city or parking company website yourself
- Use the meter's card slot if it looks intact
- Call the official phone number printed on permanent signage
- Search the city parking department website from a fresh browser tab
- Ask the lot attendant or venue staff which payment app is official
If the sign says to use a specific app, install it from the Apple App Store or Google Play Store, not from a QR landing page.
What to do if you already scanned it
Scanning a QR code is not automatically a disaster. The dangerous part is what happens after the scan.
If you scanned but did not enter information, close the page and use an official payment method.
If you entered card details:
- Call your bank or card issuer immediately.
- Ask them to watch for fraud or replace the card.
- Save screenshots of the page, the URL, and the QR sticker if you can do so safely.
- Report the fake sticker to the city, parking operator, venue, or property manager.
- Report the fraud attempt to the FTC at ReportFraud.ftc.gov.
- If money was stolen or malware was involved, report it to the FBI's IC3 at ic3.gov.
If you entered an account password, change that password from a clean browser session and enable two-factor authentication.
Business version: fake QR codes at your location
Businesses should treat public QR codes as physical security assets. If your restaurant, hotel, event venue, parking lot, or front desk uses QR codes, inspect them regularly.
Good controls include:
- Use tamper-resistant labels
- Print the destination domain next to the code
- Keep a photo record of official codes
- Train staff to spot sticker overlays
- Remove old campaign codes quickly
- Put payment instructions on your official website
- Give customers a non-QR way to verify payment links
The goal is not to ban QR codes. The goal is to make the real code easy to verify and the fake one easy to notice.
Quick checklist before you scan
Use this 15-second check:
- Touch the edge of the code. Does it feel like a sticker over another sticker?
- Read the posted payment instructions. Do they match the QR page?
- Check the URL preview. Does the domain make sense?
- Prefer the official app or website typed manually.
- Never save your card to a payment page you reached from a public sticker.
That tiny pause is usually enough to break the scam.
FAQs
Are QR codes themselves dangerous?
No. A QR code is just a way to open a link or trigger an action. The risk is that the destination can be malicious, hidden, or swapped by a fake sticker.
Can a QR code steal my card just by being scanned?
Usually no. The typical parking scam needs you to enter payment details on the fake page. Still, close unexpected pages and avoid downloading apps or files from QR links.
How do I know which parking app is real?
Use the official city, airport, venue, or parking company website to confirm the app name. Then install it from the Apple App Store or Google Play Store.
What should I do if I find a fake QR code on a meter?
Do not scan it. Take a photo if it is safe, report it to the parking authority or property manager, and use another payment method.
Bottom line
QR code parking scams work because they turn a familiar public object into a phishing link. The best defense is boring and effective: inspect the sticker, verify the domain, and pay through a trusted app or official website.
When in doubt, do not scan. Type the source yourself.
If you are unsure whether a parking payment page, text, or email is real, paste it into HelloAlpha's free scam checker at helloalpha.ai/scam-check before you enter payment information.