QR Code Parking Scams: How U.S. Drivers Can Check a Payment Link Before Scanning

• Scammers have reportedly placed fake QR codes over legitimate parking-meter codes to send drivers to lookalike payment sites.
• Before scanning, preview the URL and look for misspellings, switched letters, or a domain that does not match the parking operator.
• If you entered information or paid through a suspicious site, change reused passwords, review your accounts, contact your payment provider, and report the incident.

Fake parking QR codes are sending drivers to scam sites

The Federal Trade Commission issued a consumer alert on September 3, 2026, after reports that scammers were covering legitimate QR codes on parking meters with fraudulent replacements. A driver who scans the altered code may be sent to a fake payment page designed to collect credit-card details, login credentials, or other personal information.

The FTC has not said that every parking QR code is fraudulent, and the alert does not identify one nationwide parking operator behind the reports. The practical warning is simpler: treat a QR code on a meter or sign as a link you need to inspect, not as proof that the payment page is legitimate.

How the parking-meter QR code scam works

Many parking systems use QR codes to open a mobile payment page or an operator’s parking app. Because the code is often displayed in a public place, a scammer may be able to place a sticker over the real code without changing the rest of the meter or sign.

The replacement code can lead to a convincing copy of a parking-payment website. The page may ask for your license plate, phone number, email address, password, or credit-card information. Some fraudulent links may also try to persuade you to download an unfamiliar app or approve permissions.

A working webpage, a familiar-looking logo, or a page that knows you are trying to pay for parking does not prove that the site is genuine. The important clue is the destination address and whether it matches the parking authority, city, operator, or app you intended to use.

Check the link before you pay

Most phone cameras and QR readers show a preview of the destination before opening it. Pause at that screen. Look closely at the full web address for misspellings, extra words, switched letters, unusual punctuation, or a domain that only resembles the real operator’s name.

• Do not rely on a shortened or unfamiliar web address simply because the page uses official-looking colours or images.
• Be cautious if the code is covered by a sticker, looks damaged, is placed at an odd angle, or does not match the design of nearby meters.
• Compare the payment instructions with the meter, posted sign, or parking operator’s known website.
• If the page asks for more information than seems necessary to pay for parking, stop and verify it through another route.
• Never install an app from a QR-code page unless you have confirmed that it is the official app in the Apple App Store or Google Play.

If you have another way to pay, such as a known parking app, a meter keypad, or an official city parking website that you type yourself, use that instead of scanning a suspicious code.

Keep your phone and accounts protected

The FTC recommends keeping your phone’s operating system and apps updated. Updates can include security fixes that reduce the risk of harmful links or malicious downloads causing problems.

On an iPhone or iPad, Apple’s official instructions are to open Settings, select General, and then choose Software Update. On Android, the usual path is Settings, System, and Software updates, although the exact wording can vary by manufacturer and carrier.

Use a different strong password for every important account, especially email, banking, payment, and mobile-carrier accounts. Turn on multi-factor authentication wherever it is available. That way, a stolen password is less likely to provide immediate access to several accounts.

If you scanned a suspicious parking QR code

Scanning a code does not automatically mean your phone or accounts have been compromised. The risk is higher if you entered information, downloaded an app, approved permissions, or completed a payment. Take the following steps based on what happened:

1. Stop interacting with the page. Do not answer messages from the site, call a number it provides, or send additional information to someone claiming to help.
2. Change exposed passwords. If you entered a username or password, change it immediately on the real service’s website or app. Change it anywhere else you reused the same password.
3. Contact your payment provider. If you entered card details or see an unauthorized charge, use the number on the back of your card or the official banking app. Ask what protective or dispute steps are available.
4. Review transactions and account activity. Check bank, credit-card, payment-app, email, and mobile-carrier accounts for changes or transactions you did not authorize.
5. Remove anything unfamiliar. If you downloaded an app or granted unexpected permissions, disconnect from the site, review installed apps and permissions, and seek help from your device manufacturer or a trusted security professional.
6. Report the incident. U.S. consumers can report fraud or attempted fraud through the FTC’s ReportFraud.gov service.

Keep screenshots, the suspicious web address, receipts, transaction details, and photographs of the altered QR code if you have them. That information may help your card issuer, parking operator, local police department, or fraud-reporting agency understand what happened.

United States and Canada reporting options

The September 3 alert came from the U.S. Federal Trade Commission and is directed at U.S. consumers. If the incident happened in the United States, report it to the FTC and notify the parking operator or city that manages the meter. If money or account information was involved, contact your bank or card issuer immediately.

Canadian readers should use the Canadian Anti-Fraud Centre’s online reporting service and contact local police if they were victims of fraud or cybercrime. The Canadian centre accepts reports from victims and witnesses, including cases where there was no financial loss.

What happens next

The FTC alert confirms reports of fake QR codes being placed over legitimate parking-meter codes, but it does not announce a nationwide shutdown of QR-code parking payments or identify a single operator responsible for all incidents. Parking systems differ by city, so local officials and parking companies may issue their own warnings or replace affected signs.

For now, the safest routine is to inspect the destination before opening it, use a payment method you already recognize, and stop if the URL or page does not look right. If a QR code appears tampered with, do not scan it; photograph the sign from a safe distance and notify the parking authority through a contact method you find independently.

Helpful Links

• FTC consumer alert about parking QR codes – Read the Federal Trade Commission’s warning and recommended steps for checking QR-code links.
• ReportFraud.gov – Report a suspicious QR code, attempted fraud, identity theft, or financial loss to the FTC.
• Apple Support: Update your iPhone or iPad – Find Apple’s current instructions for installing iOS or iPadOS updates.
• Android Help: Check and update your Android version – Check your Android version, security update status, and available system updates.
• Canadian Anti-Fraud Centre: Report fraud and cybercrime – Canadian victims and witnesses can report fraud or cybercrime online and find local reporting guidance.
• FTC guidance on harmful QR-code links – Learn how QR-code phishing can lead to fake websites, stolen information, or malware.

Frequently Asked Questions

Q. Can a QR code on a parking meter be real and still be unsafe?

A. Yes. The legitimate parking system may use QR codes, but a scammer can place a fraudulent sticker over the original code. Check the physical sign and preview the destination before opening the link.

Q. What should I do if I scanned the code but did not enter any information?

A. Close the page, avoid downloading anything, and check whether an unfamiliar app or permission was added. Keeping your phone and apps updated is also a sensible precaution. If you notice suspicious activity, contact your device provider or payment provider.

Q. Should I change my password after visiting a fake parking-payment page?

A. Change your password immediately if you entered it on the page, and change it anywhere else you reused the same password. If you only opened the page and entered nothing, changing passwords is less urgent, but review your accounts if anything seems unusual.

Q. Can I get my money back after paying through a fake QR-code site?

A. Possibly, but the result depends on the payment method, timing, and provider. Contact your bank, card issuer, or payment service immediately using an official phone number or app, explain that the transaction may be fraudulent, and ask what dispute or reversal options are available.

Q. Where should Canadians report a parking QR-code scam?

A. Report it online to the Canadian Anti-Fraud Centre and contact local police if you lost money or had personal information misused. Also notify your bank, card issuer, and the parking authority involved.

Featured image: RDNE Stock project / Pexels / Pexels License