A sticker over the parking meter's QR code
On 3 September 2026 the FTC warned consumers that people have reported scammers covering up legitimate QR codes on parking meters with codes of their own. Scanning the substituted code leads to a fake site built to take payment details, personal information, or both. It is the physical version of a phishing link, and it defeats every habit people have learned about checking where a link goes.
- Year
- 2026
- Where
- United States
- Outcome
- Ongoing
- Victims
- Not stated in the sources
- Schemes
- QR code scams, Phishing and smishing, Toll and delivery texts
- Last reviewed
- 2026-09-06
The facts, as recorded
- FTC consumer alert published 3 September 2026.
- The FTC states that people have reported scammers covering up legitimate QR codes on parking meters with a QR code of their own.
- Scanning the substituted code can lead to a fake site designed to steal money, personal information, or both.
- The attack requires no technical compromise of the parking operator — only a printed sticker.
- A QR code is a URL rendered as an image, so the destination cannot be read before scanning.
Why this case matters
Every defence people have been taught about links depends on being able to see where the link goes. Hover over it. Check the domain. Look for the padlock.
A QR code is a URL you cannot read. That is the whole attack, and the parking meter version makes it concrete: no hacking, no email infrastructure, no domain to register in advance beyond the destination itself. Somebody prints a sticker and puts it over the real code.
Why parking specifically
Because the context does all the persuasion. Paying for parking by QR code is now normal, the person scanning is in a hurry, they are standing at the machine that legitimately offers the service, and the amount is small enough not to prompt a second look at anything.
The same logic applies to EV chargers, restaurant tables, parcel lockers and public transport terminals — anywhere a code is expected, unattended and physically reachable.
What actually works
The FTC’s framing — don’t scan it, yet — is the right one, because the useful check is physical rather than digital.
Look at the sticker. A code stuck on top of another one, with an edge you can feel or a slightly wrong colour, is the single most reliable tell available.
Prefer the operator’s own app, or the phone number printed on the machine, or a card reader. Use the QR code last rather than first.
Read the URL preview before opening it. Most phone cameras show the destination; a link that is a shortener, or a domain that has nothing to do with the city or operator, is where to stop.
What it tells you about the scheme
This is a good example of a scam moving toward a channel that filtering cannot reach. Email providers and mobile networks have become effective at blocking phishing links; nobody filters a sticker. As with the shift toward gold couriers in government impersonation, when the digital route gets harder, the crime returns to the physical world.
Sources
- See a QR code parked somewhere? Don't scan it…yet!. US Federal Trade Commission, Consumer Alerts. Accessed 2026-09-06. Supports: The parking-meter sticker technique, the fake payment site, and the FTC's warning that both money and personal information are targeted.
- 2025 Internet Crime Report. FBI Internet Crime Complaint Center. Accessed 2026-09-06. Supports: Phishing and spoofing complaint and loss totals, the category in which QR-based phishing is recorded.