A QR code on a parking meter sends you to a fake payment page. Here's how to spot the sticker, what to do instead, and what to do if you already paid.
You pull into a spot, walk up to the meter or the parking sign, and there's a QR code telling you to scan it to pay. It feels normal now. That's exactly why it works as a scam. In September 2026 the Federal Trade Commission warned that people have reported scammers covering real QR codes on parking meters with QR codes of their own. Scan the fake one and you land on a site built to take your money, your personal information, or both. (FTC)
Got a link you're not sure about? Check it in seconds.
Check it with ShieldrThere's no text message here. The “message” is a sticker. Someone prints a QR code, sometimes with a logo and a line like “Scan to pay for parking,” and sticks it on top of the real code on a meter, pay station or sign. When you scan it, your phone opens a web page that looks like a parking payment site. It asks for your card number, and often your name, email or phone number too.
You pay, you walk away, and nothing seems wrong. But the payment went to whoever runs the fake page, not the parking operator, and they now have your card details.
Don't contact anyone through the site you think is fake. If you entered a username or password, change it right away everywhere you use it. Then check your credit card and bank statements for charges you didn't make, and call your card issuer using the number on the back of your card to block the card. (FTC) Report it at reportfraud.ftc.gov. Because the spot may never have been paid for, keep a photo of the sticker and the time, in case you need to dispute a parking ticket.
The same trick works anywhere a QR code replaces a link: on a flyer, a restaurant table, a package, or in an email. A QR code is just a link you can't read until you scan it. Treat it the way you'd treat a link in a text from a stranger: look at where it goes before you open it, and never enter a password or card number on a page you reached that way unless you're sure it's real. Our guide on how to check if a link is safe walks through it.
Copy the link from the QR preview and share it to Shieldr. It checks the link against Google's list of known malicious sites and gives you a plain-English verdict: safe, suspicious or scam, with the reason. It's one more check before you pay, not a guarantee.
Get Shieldr on the App StoreYes. Many cities and parking companies use them, which is why the fake ones work. Check that the code isn't a sticker on top of the sign and that the link goes to the operator's real site.
Scanning shows you a link. The risk comes from opening it and entering information. The FTC also recommends keeping your phone's software updated so a bad link is less likely to cause harm.
Tell the parking operator or your city so they can remove it, and report it at reportfraud.ftc.gov. If you paid, call your card issuer right away.
Related: how to check if a link is safe, the unpaid toll text scam, the fake traffic ticket text, and how to report a scam.