Fake Parking Meter QR Codes and Other Real Scams

Fake parking meter QR codes are one of the most common real-world quishing scams: a criminal sticks a bogus code over the genuine one, and drivers who scan to "pay for parking" hand their card details straight to a fraudster. The same trick shows up on EV chargers, posters, and restaurant tables. Here's how to spot it. 🐾

Parking is the perfect target for a QR scam. You're often in a hurry, standing at the roadside, keen to pay and get on with your day. Cities and operators have made scanning-to-pay normal, so a code on a meter raises no alarm. Scammers exploit exactly that comfort — and because the attack is a physical sticker, it costs them almost nothing to deploy.

How does the fake parking meter scam work?

The mechanics are simple and, unfortunately, effective:

1. A scammer prints a QR code that links to a convincing fake payment page.
2. They stick it directly over the legitimate code on a parking meter, pay station, or nearby sign.
3. A driver scans it, expecting the official parking service.
4. The fake page asks for card details, and sometimes name, address, and phone number.
5. The driver "pays," receives nothing real, and the criminal now has their card information — and often a ticket lands anyway because no genuine payment was made.

This is textbook quishing: the QR code does nothing but point to a malicious website. The whole scam rests on you not seeing the real address before you enter your details.

The cruelest part of the parking scam is the double loss: your card is compromised, and because no real payment went through, you can still get fined.

Why parking meters specifically?

Several factors make meters an ideal hunting ground:

• You're rushed. Nobody lingers at a parking meter, so few people stop to scrutinize a code.
• Scanning to pay is expected. Many councils and operators genuinely use QR payment, so a code looks completely normal.
• Meters are unattended. A scammer can apply a sticker in seconds with no one watching.
• Weathered equipment hides tampering. Outdoor meters are scuffed and faded, so a fresh sticker blends in.

What other public-space scams use the same trick?

The sticker-over-a-real-code method isn't limited to parking. Watch for it wherever a code lives in an unattended public place:

Location	The lure
EV charging stations	"Scan to activate and pay" — captures card details
Restaurant tables	Fake "menu" or "pay your bill" codes over the real ones
Event and transit posters	Ticket or timetable codes redirecting to phishing pages
Bike and scooter rentals	Bogus "unlock" codes harvesting app logins or payment
Charity and donation flyers	Codes diverting donations to a scammer's account

All of these are variations on the same overlay theme, which we explore in more detail in how attackers sticker over legitimate QR codes.

How can I tell a fake parking code from a real one?

You don't need to be a security expert — a few quick checks catch most fakes.

1. Inspect the physical code

Is it a sticker sitting on top of the surface, or printed into the meter's official signage? Look for peeling edges, a code that overlaps or covers other printed text, or a sticker whose finish doesn't match the rest of the machine. A genuine code is usually part of the manufactured panel, not a label slapped on afterward.

2. Preview the link before paying

This is the decisive step. When you scan, read the web address before opening it. Does the domain match the parking operator or your local council? Or is it a random-looking site, a shortened link, or a look-alike domain? Using a scanner that lets you scan a code safely and see the true destination first turns a hidden trap into an obvious one. For the details of what to look for, see QR codes and malicious URLs.

3. Prefer the official channel

The safest move is to skip the on-meter code entirely. Most parking operators have an official app or a phone number and location code printed on the meter. Download the app from your device's app store yourself, or pay by phone. That way you're never trusting a code that a stranger could have replaced.

What should I do if I've already scanned a fake code?

If you entered card details on a suspicious parking page:

• Contact your bank immediately to freeze the card and watch for fraudulent charges.
• Change any password you may have entered, especially if you reused it elsewhere.
• Keep the evidence — photograph the meter and the sticker if you can do so safely.
• Report it to the parking operator, the venue, and the relevant fraud authority. Our guide on how to report a malicious QR code walks through each step.

A calm way to think about it

Parking QR scams sound alarming, but the defense is genuinely simple and doesn't require you to distrust every code. Slow down for the few seconds it takes to look at the sticker and read the link. If either seems off, use the official app instead. That small habit protects you against not just parking scams but the whole family of public-space overlay attacks. And when you're making codes for your own business or event, you can create a free QR code that encodes your real destination directly — no hidden redirect for anyone to abuse.

Frequently asked questions

How common are fake parking QR code scams?

They're a well-documented and recurring problem in many cities, precisely because they're cheap to deploy and prey on people in a hurry. You don't need to panic, but you should treat any on-meter payment code with a quick check before using it.

How do I know if a parking QR code is genuine?

Check whether it's part of the meter's printed panel or a stuck-on sticker, then preview the link and confirm the domain belongs to the parking operator or council. If anything looks off, use the operator's official app or phone-payment line instead.

Is it safer to use a parking app instead of scanning?

Yes. Downloading the official app from your device's app store and paying through it means you're never relying on a code that a stranger could have covered with a fake. It's the most reliable way to avoid overlay scams.

What happens if I paid a fake parking code?

Contact your bank right away to protect your card, change any reused passwords, and report the incident to the parking operator and fraud authorities. Because no real payment was made, also check whether you still owe the genuine parking fee to avoid a fine.

Do EV chargers have the same problem?

Yes. EV charging stations are unattended and use scan-to-pay, so they're vulnerable to the same overlay trick. Preview the link before paying, and prefer the charging network's official app whenever possible.