Parking Meter QR Code Scams: How Fake Stickers Steal Your Card

TLDR

Criminals are placing fake QR code stickers over legitimate parking meter payment codes across American cities. When you scan the fake code and enter your credit card information, it goes directly to the scammer instead of the parking payment processor. The FBI, USPS, and local police departments in Austin, Houston, San Antonio, and dozens of other cities have issued warnings. ScamVerify™ tracks 74,032 malicious domains through URLhaus and can check any QR code at the ScamVerify QR scanner before you enter payment information.

How the Parking Meter Scam Works

The scam is simple and effective. Here is the step-by-step process criminals use:

1. Scammer prints QR code stickers that link to a fake parking payment website
2. Stickers are placed directly over the legitimate QR code on parking meters, pay stations, or posted signage
3. Driver arrives and scans the QR code expecting to pay for parking through the official system
4. Fake website loads on the driver's phone, designed to look like the real parking payment portal
5. Driver enters credit card information, license plate number, and parking duration
6. Scammer captures the payment data and uses it for fraudulent charges
7. Driver's car may still get a ticket because no legitimate payment was processed

The scam works because people are in a hurry. You pull up to a meter, see a QR code, scan it, and pay. The entire interaction takes under a minute. That speed is the scammer's advantage. Nobody pauses to inspect a parking meter QR code for signs of tampering.

Where Parking QR Scams Have Been Reported

This is not a theoretical threat. Law enforcement agencies across the country have documented cases:

Texas cities were among the first to report the scam at scale, but it has since spread nationwide. Any location that uses QR codes for parking payment is a potential target.

What the Fake Payment Sites Look Like

The fraudulent parking payment sites are designed to mimic legitimate services. Common features include:

• City or parking company branding (logos, color schemes, city names)
• Standard payment form fields (credit card number, expiration date, CVV, ZIP code)
• License plate and zone entry (makes it feel like a real parking transaction)
• Duration selection (hourly rates that match actual parking costs)
• SSL certificate (the padlock icon appears, creating false trust)
• Mobile-optimized layout (designed specifically for phone screens since that is how people scan QR codes)

The sophistication varies. Some fake sites are obvious to a careful observer, with slightly wrong branding or unusual URLs. Others are nearly pixel-perfect copies of the real payment portal.

How to Spot a Fake Parking QR Code

Physical Inspection

Before scanning any QR code on a parking meter or pay station:

1. Look for sticker overlays. Run your fingernail along the edge of the QR code. If it is a sticker placed on top of another surface, that is a red flag. Legitimate QR codes are typically printed directly onto the meter or on an official metal placard.
2. Check alignment. A hastily placed sticker may be slightly crooked or misaligned compared to the rest of the meter's labeling.
3. Look at neighboring meters. If the QR code on your meter looks different from the ones on adjacent meters (different size, different placement, different sticker material), something is wrong.
4. Check for damage or residue. Scammers sometimes peel off the legitimate QR code to place their own. Look for adhesive residue, scratches, or other signs of tampering.

Digital Verification

After scanning but before entering payment information:

5. Read the URL carefully. Does the domain match the city's known parking payment service? Cities like Austin use ParkATX, Chicago uses ParkChicago, etc. A URL like parking-pay-austin.com is not the official service.
6. Check for HTTPS. While HTTPS alone does not prove legitimacy (scammers can get free SSL certificates), a site without it should be an immediate dealbreaker.
7. Scan through ScamVerify QR scanner before entering any information. Upload a photo of the QR code and get the destination URL checked against 74,032 known malicious domains.

Alternative Payment Methods

8. Use the official parking app directly. Download the city's official parking app from the App Store or Google Play (not from a QR code). Pay through the app rather than scanning.
9. Pay at the meter. Most parking meters still accept coins, credit cards through the built-in card reader, or contactless tap payments. These are harder to compromise than a QR code sticker.
10. Call the number on the meter. Some meters list a phone number for payment assistance. Verify this number independently before calling.

What to Do If You Scanned a Fake Parking QR Code

If you entered payment information on a suspicious parking payment site:

1. Contact your bank or credit card company immediately. Report the card as potentially compromised and request a new card number.
2. Review your recent transactions. Check for any unauthorized charges, including small test charges that scammers use to verify a card works before making larger purchases.
3. File a police report with your local department. This helps law enforcement track the scope of the scam in your area.
4. Report to the FTC at reportfraud.ftc.gov.
5. Take a photo of the meter and note the location. Report it to the city's parking department so they can remove the fake sticker and warn other drivers.
6. Monitor your credit through the free annual report at AnnualCreditReport.com.

Why Parking QR Scams Are Growing

Several factors make parking meters attractive targets for QR code fraud:

Low risk of detection. A small sticker on a parking meter is unlikely to be noticed by parking enforcement officers, who are focused on checking for expired meters rather than inspecting QR code authenticity.

High traffic volume. A single compromised meter in a busy downtown area can capture dozens of credit card numbers per day. Prime locations near restaurants, entertainment venues, and government buildings see the highest traffic.

User urgency. People paying for parking are typically in a hurry to get somewhere. They scan and pay as quickly as possible, with minimal scrutiny of the payment site.

Trust environment. A QR code on a parking meter inherits the trust of its physical context. People trust parking meters as municipal infrastructure. The QR code on the meter benefits from that trust even when it is a fraudulent overlay.

Low cost of attack. Printing QR code stickers costs pennies. A scammer can compromise dozens of meters in an evening with a sheet of stickers and some adhesive.

The USPS Warning

The United States Postal Service issued a public advisory about QR code scams, noting that parking meters are one of the most common physical locations where fraudulent QR codes appear. The USPS advisory emphasized that consumers should "never scan a QR code from an unexpected source" and should verify the destination URL before entering any information.

The advisory also warned about QR codes appearing on fake package delivery notices, which is a related vector. A fake USPS notification with a QR code on your door is the postal equivalent of a fake parking QR code on a meter.

FAQ

How common are parking meter QR code scams?

Law enforcement has documented cases in Austin, Houston, San Antonio, and dozens of other cities. The FBI, USPS, and multiple state attorneys general have issued public warnings. The exact number of compromised meters is unknown because many incidents go unreported. Victims often do not realize they were scammed until they see fraudulent charges on their card statements days or weeks later.

Can I tell a fake QR sticker from a real one just by looking?

Sometimes. Run your fingernail along the edge. A sticker overlay will have a perceptible edge, while a printed QR code will be flush with the surface. Compare to neighboring meters. If your meter's QR code looks different (different size, placement, or material), that is a warning sign. However, high-quality stickers on clean surfaces can be very difficult to detect visually.

What if I already paid through a fake parking QR code?

Contact your bank or credit card company immediately and request a new card number. Check your recent transactions for unauthorized charges. File a report with local police and the FTC at reportfraud.ftc.gov. Take a photo of the meter and report the fake QR code to your city's parking department.

Are cities doing anything to prevent this?

Some cities have started phasing out QR codes on parking meters in favor of NFC tap-to-pay, dedicated parking apps, or built-in card readers that are harder to tamper with. Others have increased meter inspections. However, the shift away from QR-based parking payment is slow, and many cities continue to rely on QR codes as part of their payment infrastructure.