The Fake QR Code on the Parking Meter: How to Check Before You Pay

You are parked, you are already late, and the machine wants money. There is a QR code on the front of it and a line of text telling you to scan to pay. Your card is in your hand. The whole transaction is going to take ninety seconds.

This is the exact moment the scam is designed for. Not because you are careless, but because a parking machine is the one place where an unexpected QR code asking for a card number is completely normal. Nobody is suspicious of a payment prompt on a payment device.

So the advice you will read everywhere — don't scan QR codes you don't trust — is close to useless here. Plenty of parking operators genuinely do want you to scan a code. The question is not whether to scan. It is how to tell, in the fifteen seconds you actually have, whether the code in front of you is the operator's or somebody else's.

The Short Answer

• The scam is physical, not digital. Somebody prints a sticker and puts it over the real QR code. The machine is untouched and working perfectly; only the code has been swapped.
• Look at the sticker before you look at the screen. A code applied over another one usually shows it — a raised edge, a bubble, a slight misalignment, different paper or gloss, or a code that covers printed text it should not be covering.
• Read the address before you open it. Most phones show you the destination and wait for a tap. That preview is the single most valuable second in the whole process, and most people tap straight past it.
• Check the name in the address against the name on the machine. Fakes rely on near-misses — one reported case pointed at a site spelled poybyphone, one letter off a real operator.
• If the code is the only way to pay, be more suspicious, not less. A machine with a working card reader and a coin slot gives you a way around the question entirely.
• If you already paid, treat it as a stolen card number — not as a parking problem. Call your card issuer first; the parking ticket is the cheaper of the two problems.

Why Parking Machines Specifically

Fake QR codes turn up in a lot of places, but parking has become the headline case, and the reasons are worth understanding because they tell you where else to expect it.

The hardware stands outdoors, unattended, for years. A restaurant table code gets wiped down by staff twice a day. A parking machine on a side street may go weeks without anybody looking closely at its front panel.

A payment request is in character. This is the decisive one. If a sticker on a lamp post asks for your card details, the request itself is the warning. On a parking machine, paying is the entire point of the object. The attacker does not have to invent a pretext.

You are under time pressure, and you are standing up. You are on a pavement, possibly in the rain, with a meter running. Nobody reads a URL carefully in that posture.

Legitimate parking QR codes really do exist. Cities have spent a decade moving drivers onto pay-by-phone apps, and many of them put a code on the machine deliberately. The scam borrows that credibility. If parking authorities had never used QR codes, the sticker would fool nobody.

And the amounts are small. A fake parking page asks for a few pounds or dollars. The charge looks right, the page says thank you, and many victims never connect the later fraudulent transactions to the car park. The card number is what was being harvested; the parking fee was the plausible cover.

What Happened in 2026

This stopped being a theoretical risk during 2026, and the case record is now specific enough to be useful.

In early September 2026 the US Federal Trade Commission published a consumer warning about scammers placing their own stickers over legitimate QR codes on parking meters, describing codes that lead to copycat payment pages built to collect card and login details.

In October 2026 the scam produced a prosecution. Manhattan prosecutors indicted a Brooklyn man, Mihai Theodor Enescu, over an alleged scheme at New York City parking kiosks; investigators reported recovering 64 stickers directing drivers to a site impersonating the city's official ParkNYC payment platform. He has denied wrongdoing, and the case had not been tried at the time of writing. New York City's own guidance is that metered parking should be paid at the machine or through the official ParkNYC app, which is operated by Flowbird and is the only app the city approves for the purpose.

The pattern is not confined to large cities, which is the part most coverage understates. In early October 2026 the Fort Bend County Sheriff's Office in Texas warned residents about fake codes placed over genuine ones. Police in New Westminster, British Columbia went further and asked anyone who had paid for parking by QR code in the preceding five days to check their bank and card statements — a useful signal that the window between the sticker going up and the fraud appearing is short.

The same technique has also moved off the street. Also in October 2026, Norfolk County Council in England warned that letters purporting to be council tax correspondence, carrying QR codes that led to a payment-harvesting site, were circulating and were not genuine. A retired police officer in Michigan reported losing thousands after scanning a code found inside the box of a newly purchased television. Different settings, identical mechanism: put a code where a payment or registration is expected, and let the context do the persuading.

Defenders are responding, though mostly on the corporate side. Microsoft began rolling out QR-code phishing detection in Teams in early October 2026, following similar additions to email filtering. That helps with codes that arrive in a message. It does nothing at all for a sticker on a machine, which is why the physical check still falls to you.

Check the Sticker Before You Check the Screen

The most reliable tell is not on your phone. It is the two seconds you spend looking at the code itself, because a code placed over another code is a physical object sitting on top of another physical object, and that is hard to hide.

Run a thumbnail along the edge of the code. If it catches, something is on top of something. That is not proof of fraud — operators do sometimes apply legitimate update stickers — but it moves the code from "probably fine" to "verify properly", which is the right place for it.

Read the Address Without Going There

Suppose the sticker looks fine, or you cannot tell. The next check is the one that actually settles it, and almost everybody skips it.

Scanning a QR code and opening what it points at are two separate actions. A QR code holds text. When that text is a web address, your phone's camera shows it to you and waits for a tap. The scan itself is inert: nothing has loaded, nothing has run, and you have given nothing away. People describe scanning a bad code as the moment of harm, but the harm is in the tap that follows, and you have as long as you like before you make it.

So read it. On the preview, you are looking for one thing: the registered domain — the part immediately before the first single slash, reading right to left from there. Everything else is noise, and the noise is deliberate.

Two traps are worth naming because they beat careful readers. The first is the subdomain trick in the first two rows: any operator's name can be put to the left of a domain the attacker owns, and it reads perfectly naturally. The second is character substitution — a Latin "l" for a capital "I", a digit "0" for an "O", or a letter from another alphabet that renders identically. You cannot reliably catch those by eye on a phone screen in the rain.

Which is why the useful habit is not "spot the fake" but match the name. The machine in front of you tells you who collects your money. If the domain is not that operator's own name, you stop — regardless of how respectable the rest of the address looks. And if you are unsure what the operator's real address is, the city or council website is the place to settle it, not the sticker.

If you want to inspect an address properly rather than squint at a preview, our QR Code Link Checker pulls apart a scanned URL and shows you the registered domain separately from the subdomains and path, flags shorteners and lookalike characters, and does it without loading the page. Our QR Code Payload Decoder does the same for codes that are not links at all.

The Questions the Machine Itself Answers

Before you decide, three things about the machine are worth a glance, because they are often more informative than the code.

Is there another way to pay?

A working card reader or coin slot means you never have to resolve the question. Use it. The few seconds a QR code saves is not worth the analysis, and this is the single best piece of practical advice in this article: when a non-QR payment route exists, take it.

Does the code's operator match the machine's operator?

Parking machines are emphatically branded — the city, the authority, or the operator's name is on the panel, usually more than once. A code that resolves to a company named nowhere on the machine is a mismatch, and a mismatch on a payment flow is enough on its own.

Is the page asking for more than parking needs?

Paying for a parking session needs a plate number, a bay or zone number, a duration, and a payment method. It does not need your date of birth, your driving licence number, your address, or a password for an account you do not have. A request for any of those means you are not on a parking page, whatever it looks like. Legitimate operators also do not need you to install anything to pay once.

If You Already Scanned and Paid

The order matters here, because the expensive problem is not the one that feels most urgent.

1. Contact your card issuer now. Report the card as compromised and ask about a replacement. You handed a working card number, expiry and security code to somebody who collects them deliberately; assume it will be used or sold. Most issuers can freeze a card from the app in under a minute.
2. Check what else you typed. If you reused a password on that page, change it everywhere you used it, starting with your email. If you entered an account login for a real parking operator, change that too — a working account is worth more than a single card charge.
3. Review recent statements, not just today's. Police in New Westminster asked drivers to look back five days, which is a reasonable floor. Look for small test charges as well as large ones; verifying a stolen card usually starts with an amount small enough to ignore.
4. Assume you have not paid for parking. Your money went to the attacker, not the authority, so the session was never valid. Pay again properly, by another method. A fine is possible, and worth appealing with the evidence below.
5. Photograph the sticker, then report it. Tell the parking operator or the local authority so the sticker comes off — on a busy machine that is the single highest-value thing you can do, because it protects everyone who parks there next. In the US, report to the FTC at reportfraud.ftc.gov; elsewhere, use your national fraud reporting service. The photograph is also your evidence if you need to contest a ticket.

What you should not do is wait to see whether anything happens. The gap between handing over a card number and the first fraudulent charge can be days, and the cost of a precautionary card replacement is an afternoon of updating subscriptions.

Why "Just Look at the URL" Is Harder Than It Sounds

It is worth being honest about the limits of the advice in this article, because confident advice that quietly fails is worse than none.

A QR code is a container for text, and nothing about the pattern of squares tells you what the text says or where it goes. There is no visual difference between a safe code and a malicious one — you cannot learn to recognise a bad QR code by looking at it, and any guide that implies otherwise is wrong. The information is in the text, and the text is only readable after a scan.

Beyond that, three things genuinely work against a careful reader:

• Redirects. A respectable-looking address can forward to somewhere else entirely after you tap. What you previewed is the first hop, not necessarily the destination.
• A padlock proves nothing relevant. HTTPS means the connection is encrypted, not that the operator is who they claim. Phishing sites have certificates; they are free.
• Plausible design is cheap. A copycat payment page can be a pixel-perfect copy of the real one, because the real one is public and can simply be downloaded.

This is why the recommendation above is the structural one rather than the forensic one: prefer a payment route that does not involve the code, and when you must use a code, match the domain to the operator named on the machine. Those two habits do not depend on you out-reading an attacker who has had all night to prepare.

For the wider picture — codes in emails and PDF attachments, which is now where most QR phishing actually happens — see our guide to spotting fake QR codes. The unexpected-package scam is the same trick with a parcel instead of a meter, and whether a QR code can be changed after printing explains why a code you trusted last month can point somewhere new today.

For Operators and Councils

If you run the machines rather than park at them, the sticker is your problem too, and a few design choices make it much harder to pull off.

• Print the code, do not stick it on. A code printed directly into the panel graphic or etched into the housing cannot be peeled, and any sticker over it is obvious.
• Print the domain in plain text next to the code, in your own typeface. It gives drivers something to match against without reading a URL on a phone screen, and it makes a mismatched sticker self-evident.
• Keep a non-QR payment route working. A machine where the code is the only option trains drivers to trust whatever code is on it.
• Use your own domain, not a shortener, and not a third-party campaign domain. Every redirect you add is one you have taught your customers to accept.
• Add the code's condition to inspection rounds. Whoever empties the coins can photograph the front panel. Fakes have a short lifespan if anybody is looking.
• Say so on your website. Publish the exact domain your payment pages use, so a driver who wants to check has somewhere authoritative to check against. Several cities now do this; it costs nothing.

Frequently Asked Questions

Is it dangerous to scan a QR code, or only to open the link?

Scanning by itself is safe. A QR code is static text, and your camera reads it and shows it to you; it cannot run code or install anything. The risk begins when you tap through to the destination and start entering information. That gap between scan and tap is where all of your defence lives, so the habit worth building is reading the preview rather than tapping past it.

Can someone tell a fake QR code just by looking at the pattern?

No, and this is the most common misconception about QR codes. The pattern encodes text, and any text can be encoded into a valid-looking code. A code pointing to a city parking portal and one pointing to a credential-harvesting page are visually indistinguishable. The only way to know is to read the decoded text.

Are the QR codes on parking machines legitimate at all?

Often yes. Many parking authorities and operators put codes on their machines deliberately as a route into their pay-by-phone service. That is precisely what makes the scam viable. Treat a parking QR code as plausible but unverified: check the sticker physically, then match the domain against the operator named on the machine.

How do I know what the real parking website should be?

From a source that is not the sticker. The operator is usually named on the machine itself, and the city or council website will name the app or payment provider it uses. If the machine says one company and the code resolves to another, that is a mismatch worth stopping on. New York City, for instance, states that ParkNYC — operated by Flowbird — is the only app it approves for metered parking.

The address looked right. Could it still be fake?

Yes, in two specific ways. An operator's name can appear as a subdomain of a domain the attacker controls, so parknyc.something-else.com belongs to something-else.com. And characters can be substituted for near-identical ones, which is very hard to catch on a phone screen. Read right to left from the first single slash and identify the registered domain; if you cannot do that confidently, use another payment method.

I paid through a fake parking page. Will I still get a ticket?

Possibly, because your payment never reached the parking authority and no valid session was created. Pay again by another method if you are still parked, photograph the sticker, and keep the evidence — a fake code on the machine is a reasonable basis to contest a penalty, and reporting it helps whoever parks there next. Deal with your card first, though: that is the larger exposure.

Does a padlock in the address bar mean the payment page is safe?

No. The padlock means the connection to that site is encrypted, not that the site is run by who it claims. Certificates are free and automatic, and phishing pages routinely have them. It tells you nobody is eavesdropping while you hand your card details to the wrong person.

Should I just stop using QR codes to pay for things?

That is a defensible position for payments specifically, and it costs you very little — a card reader or a coin slot does the same job. The broader habit worth keeping is narrower than avoiding QR codes entirely: be wary when a code asks for money or credentials, and relaxed when it only opens a menu or joins a Wi-Fi network. The payment context is where the money is, so it is where the stickers go.

The Short Version

A parking machine is the ideal host for a fake QR code, because asking you for a card number there is the least suspicious thing in the world. The attack is a sticker, and a sticker leaves marks: look at the edges before you look at your phone.

Then use the second your phone gives you. Read the domain, match it to the operator named on the machine, and if they do not match — or if you cannot tell — pay with the card reader instead. If you have already paid, the parking fee is not the problem; the card number is. Call the issuer, then photograph the sticker and report it, because the next driver gets no warning at all.