About to scan a QR code to pay? Check it first.
Be suspicious of any QR code stuck on a meter or sent unexpectedly; pay through the machine, the official app or a web address you type yourself.
The check
Answer these honestly. A single "yes" to a warning sign is enough to stop.
- Is the QR code a sticker on a meter or sign?Mississauga, Canada, says it never collects parking payments by QR code; Christchurch, New Zealand, says it would never ask for payment that way. Check your city's own rules.
- Does the web address in the preview match the official operator, spelled exactly right?The FTC says to look at the link preview for misspellings or switched letters before you open it.
- Did this code arrive in a text, email or package you weren't expecting?The FTC says don't scan QR codes in messages you weren't expecting, especially urgent ones.
- Is the page asking you to log in, or for more than the parking fee?A payment page that wants passwords or extra personal details is a red flag for phishing.
- Can you pay on the machine's own screen or the official app instead?That's the safe route. Mississauga tells drivers to use the payment prompts on the machine's screen.
If it's happening right now
If you haven't paid yet, don't. Use the meter's own screen, the official parking app, or a web address you type yourself. If you already entered card details, call your card company now using the number on the back of the card. If you entered a password, change it.
How this scam works
Scammers stick their own QR codes over, or next to, real ones on parking meters and pay stations. In one city they also scribbled over the meter screens so people would scan instead.
The code opens a fake payment page that takes your card details, your money, or both.
QR codes also arrive by text, email or in a parcel you didn't order, with a story about a missed delivery, a problem with your account or a gift.
A code can also lead to a page that tries to install malware or collect passwords.
What AI changes
AI isn't what makes this scam work: a printed sticker does. The FBI says criminals use generative AI to write content for fraudulent websites, which can make the page a code opens look more convincing, so judge the web address rather than how polished the page looks.
What to do, step by step
- Close the page and don't interact with it.The FTC says engaging with a fake site can expose you to more requests for money or data.
- Call your card issuer or bank if you paid.Use the number on the back of your card and ask about stopping or disputing the charge. The FTC says federal law protects you from unauthorized card use.
- Change passwords you typed in.Change them on any other account that uses the same password too, and turn on multi-factor authentication.
- Watch your statements.Look for charges you don't recognize over the next weeks.
- Tell the parking operator or city.They can remove the stickers before others are caught. Note where the meter was.
- Report it.To the FTC at ReportFraud.ftc.gov, and to local police if you lost money.
How big this is
Real cases
- Christchurch, New Zealand. Fake QR payment stickers turned up on council and private parking machines across the city, and some meter screens were defaced with permanent marker to push people to scan. The council said it would never ask for payment by QR code. (1News)
- Mississauga, Canada. The city removed about 80 fraudulent QR stickers from downtown parking machines that sent drivers to payment sites it doesn't run. (City of Mississauga)
- United States. The FTC warned that scammers are placing their own QR codes over legitimate ones on parking meters to steal money and personal information. (FTC)
Where to report it
- The FTC: ReportFraud.ftc.gov
- The parking operator or your city: the number or app shown on official signs (not on the sticker)
- Your card issuer or bank: the number on the back of your card
Questions people ask
Can scanning a QR code hack my phone?
It can lead somewhere harmful. The FTC warns a QR code could install malware that steals information, or open a phishing site. Keep your phone's software updated and don't scan unexpected codes.
I scanned it but didn't pay. Am I OK?
Probably, if you didn't enter anything. If you typed a password, change it. If you entered card details, call your card company.
How do I pay for parking safely?
Use the payment screen on the machine, the operator's official app, or a website you type in yourself. Mississauga, for example, takes coins, cards and phone wallets at the machine.
A parcel I didn't order has a QR code to 'find out who sent it'. Should I scan it?
No. The FTC says that's a known scam, sometimes part of 'brushing'. You can keep a real gift, but don't scan the code.
Will my bank refund a payment to a fake parking site?
If you paid by credit or debit card, call right away and ask for a refund. The FTC says federal law protects you from unauthorized card use. Speed matters.
Related
- AI scam texts: how to spot them and what to do (2026) →
- Is this online store real or a scam? Fake review checks →
Sources
- FTC: See a QR code parked somewhere? Don't scan it…yet! (Sep 3, 2026)
- FTC: Scammers hide harmful links in QR codes to steal your information (Dec 2023)
- FTC: Scam alert: QR code on an unexpected package (Jan 23, 2025)
- City of Mississauga: City warns about fraudulent QR codes on parking machines (Apr 24, 2026)
- 1News: Fake QR code payment stickers found on Christchurch parking meters (Jul 14, 2026)
- FBI IC3: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (PSA I-120324, Dec 3, 2024)
- FTC: What To Do if You Were Scammed
Spot an error or something out of date? Tell us; corrections are made and logged. Written with AI assistance from public sources; every fact checked and approved by Colin Balfe. General information, not legal, medical or financial advice.