Parking meter QR codes are getting hijacked by scammers

According to the Federal Trade Commission, scammers have started sticking fake QR codes over the real ones on parking meters. A driver looking for a quick way to pay gets sent somewhere else entirely.

The FTC says people have reported scammers covering legitimate parking meter QR codes with codes of their own. Scan one of those, and it can lead to a fake site built to take a payment, a password, or both.

The step the scam depends on

The scam works because a QR code hides its destination until the moment someone scans it. A parking meter looks the same whether the code on it is genuine or not. The sticker underneath does the deceiving, not the meter itself. That gap between what a code looks like and where it actually leads is the entire mechanism.

This is also why the FTC's advice centers on the one moment a person still has control: before tapping through. Most QR readers show a preview of the link first. Checking that preview for a misspelled word or a swapped letter is the only point in the whole transaction where a fake can be caught before any money or information moves.

What to check before scanning

• Look at the link preview the QR reader shows, and check it for spelling mistakes or switched letters before opening it.
• Keep the phone's operating system and apps updated, using Apple's or Android's own update guides, so a bad link has less to work with if it does get clicked.
• Use strong, unique passwords with multi-factor authentication on accounts, so one scanned code cannot unlock everything else.

What to do after a bad scan

If a code turns out to be fake, the FTC's advice is not to engage with whoever runs the site behind it. Reaching out through that page, even to complain, gives a scammer another opening to ask for money or details.

Anyone who entered a username or password on the fake site should change it immediately, and change it anywhere else that password gets reused. Bank and credit card statements are worth checking afterward too, for any transaction that was not made.

Why this is worth flagging now

A sticker over a parking meter is a small, physical thing, easy to place and easy to miss. Patterns like this, a familiar object turned into a delivery method for a scam, are exactly what automated scam-monitoring is built to catch early, before a local trick spreads to more meters and more cities.