Parking QR Code Scam Alert: How to Check the Payment Link Before You Pay

Scammers may place fake QR-code stickers over legitimate parking-meter codes and send drivers to phishing pages or malware.
Before entering payment details, preview the URL, check for misspellings and unfamiliar domains, and confirm the parking operator through an independently verified website or app.
If you entered card or account information, contact your financial institution immediately, change reused passwords, monitor transactions, and report the scam.

Parking QR code scams are targeting drivers who pay by phone

On September 3, 2026, the Federal Trade Commission warned that scammers may cover legitimate parking-meter QR codes with fake stickers. The replacement code can send you to a convincing payment page designed to steal card numbers, usernames, passwords, or other personal information. In some cases, scanning the code may also expose your phone to malware.

The safest approach is simple: don’t enter payment information just because a QR code opens a page that looks official. Pause, preview the web address, and confirm that you’re using the parking operator’s real payment channel.

Updated September 15, 2026.

How the parking-meter QR code scam works

A criminal can place a sticker over the QR code already attached to a parking meter, sign, kiosk, or pay station. The fake code may use the city’s name, a familiar parking brand, official-looking colours, or a page that copies the real payment form.

After scanning, you may be asked to enter your license plate number, card details, account password, phone number, or a verification code. That information can then be used for unauthorized charges, account takeovers, identity theft, or additional phishing attempts.

This isn’t limited to parking meters. The Canadian Anti-Fraud Centre also warns that QR codes can direct people to fraudulent websites, request banking information, or potentially infect a device or network. The same warning applies to QR codes received by unexpected text messages, emails, or social-media messages.

How to verify a parking payment link before entering card information

Use this quick check before typing anything into a page opened by a QR code.

Preview the URL first. Most phone cameras and QR scanners show the destination before opening it. Read the full address rather than judging the page by its logo or layout.
Check the domain carefully. Look for swapped letters, extra words, unusual hyphens, shortened links, or a domain that has no obvious connection to the city, parking authority, or named payment provider. A padlock or HTTPS alone doesn’t prove that the site is legitimate.
Confirm the operator independently. Search for the city, parking authority, or parking company yourself, or use an official app you already know. Don’t rely on a phone number or website address printed on a suspicious sticker.
Compare the payment flow. Check whether the official site or app identifies the same location, zone, meter number, license-plate format, and payment methods. A mismatch is a reason to stop.
Don’t surrender unnecessary information. A parking payment generally shouldn’t require your email password, banking login, Social Security number, Social Insurance Number, or a one-time security code.
Use another payment route if anything feels off. Look for the meter’s keypad, a nearby official pay station, or the parking operator’s verified app. If no safe option is available, contact the parking authority using contact information you found independently.

Read the FTC parking QR code scam alert

Red flags that the QR code or payment page may be fake

Warning sign	Why it matters
The sticker looks loose, layered, scratched, or recently applied	It may have been placed over the original code.
The URL uses a misspelled or unfamiliar domain	Scammers often use lookalike addresses to imitate legitimate services.
The page creates urgency or threatens a penalty	Pressure makes it easier to overlook a suspicious link or request.
The page asks for a banking login or verification code	That information is not normally needed to pay a parking meter.
The location, meter number, or license plate details don’t match	The page may not be connected to the parking service at all.
The QR code came from an unexpected text or email	Unsolicited QR codes are a common phishing route.

A polished design is not proof of authenticity. Phishing pages can copy real logos, fonts, payment buttons, and legal language. The web address and independent confirmation matter more than the appearance of the form.

What to do if you entered card or account information

Act quickly, but don’t panic. The sooner you contact the relevant provider, the more options you may have.

Contact your card issuer or bank immediately. Use the number on the back of your card, the official banking app, or a statement—not contact information from the suspicious page. Tell the representative that your information was entered on a suspected phishing site and ask whether the card should be locked, replaced, or monitored.
Review transactions. Check your credit-card, debit-card, and bank-account activity for charges you don’t recognize. Continue checking over the next several weeks, including small test charges.
Change compromised passwords. If you entered a username and password, change it through the real service. Change the same password anywhere else you reused it, and turn on multifactor authentication.
Secure the phone. If the page caused a download or you installed an app, update the operating system and security software. Remove anything unfamiliar and run the device’s security scan.
Report the incident. U.S. readers can report scams to the FTC. Canadian readers can report fraud to the Canadian Anti-Fraud Centre and local police when appropriate.

Get the FTC recovery steps after a scam Report fraud to the Canadian Anti-Fraud Centre

If you entered a Social Security number in the United States, use the federal identity-theft recovery process. If you provided sensitive identity information in Canada, contact the affected financial institution and report the incident through the Canadian reporting channels.

Start the federal identity-theft recovery process

United States and Canada: what differs

United States

The FTC’s guidance is to inspect the URL before opening it, avoid unexpected QR codes, keep your phone updated, use strong passwords and multifactor authentication, and review financial transactions after a suspected scam. If a credit or debit card was used fraudulently, contact the issuer or bank immediately and ask about reversing the transaction.

Canada

The Canadian Anti-Fraud Centre treats QR-code scams as a form of phishing and advises people to verify official websites and contact information independently. Canadians who believe they’ve been targeted should contact their financial institution, report the incident to the CAFC, and contact local police if they were victims of fraud.

The basic safety check is the same in both countries: don’t trust the QR code by itself. Verify the destination and payment operator through a separate, trusted route.

What happens next after the FTC warning

The FTC warning is an ongoing consumer-safety alert, not a notice of a single nationwide parking-system shutdown. Cities and parking operators may use different payment providers, apps, and fallback options, so the correct destination depends on the location where you parked.

If a QR sticker appears damaged, layered, or inconsistent with nearby meters, avoid scanning it and notify the parking authority. Take a photo only if it’s safe to do so, and record the street, meter number, time, and payment provider. That information can help the operator remove a fake sticker and warn other drivers.

For now, the practical status is straightforward: QR-code parking payments remain usable, but the code should be treated as an unverified link until the destination and operator match.

Helpful Links

FTC parking QR code scam alert – Read the Federal Trade Commission’s warning and recommended checks for QR codes placed in public locations.
FTC guidance for people who were scammed – Find steps for contacting card issuers, changing passwords, protecting accounts, and reporting a scam.
Canadian Anti-Fraud Centre QR code fraud bulletin – Review Canadian guidance about QR-code phishing, malicious websites, and independent verification.
Canadian Anti-Fraud Centre phishing guidance – Learn how to recognize phishing and report suspected fraud in Canada.
Canadian Anti-Fraud Centre fraud reporting system – Official page referenced in the article.
IdentityTheft.gov – Recovery Steps – Official page referenced in the article.

Frequently Asked Questions

Q. Can a QR code be safe if the payment page uses HTTPS?

A. Yes, a legitimate payment page can use HTTPS, but HTTPS only encrypts the connection. It does not prove that the website belongs to the city, parking authority, or payment provider. Always inspect the domain and verify the operator independently.

Q. Should I scan a QR code printed on a parking meter?

A. You can, but treat it as an unverified link. Inspect the previewed URL, compare the location and meter details, and use the official parking app or website instead if the sticker looks altered or the address seems unfamiliar.

Q. What if I scanned the code but didn’t enter any information?

A. Close the page and don’t download anything or grant permissions. If an app or file was installed, remove it, update your phone, and run a security check. Continue watching your accounts if the page requested access or login details.

Q. Do I need to cancel my card after entering details on a fake parking page?

A. Contact the card issuer immediately and explain what happened. The issuer can advise whether to lock the card, replace it, dispute a charge, or monitor the account. Don’t wait for an unauthorized transaction to appear before reporting the exposure.