# Parking QR code scams: how they work and how to avoid them

> Scammers stick fake QR codes on parking meters and signs that lead to convincing payment pages which harvest card details. The FTC and FBI have both warned about this scam. Pay through the official parking app or the meter itself, and check the domain before entering any card number.

Source: https://useqr.app/docs/security/parking-qr-code-scams · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## Why parking is the perfect target

Parking QR scams are the best-documented class of QR fraud, with public warnings from the
FTC, the FBI and local authorities on both sides of the Atlantic, and some UK councils have
stopped putting QR codes on parking machines altogether because of it. The conditions are
ideal for an attacker:

- The victim is **in a hurry** and expects to pay a stranger's machine.
- The machine is **unattended**, so a sticker sits unnoticed for days.
- Entering **card details** on an unfamiliar website feels normal here, because dozens of
  legitimate parking operators each use their own payment domain.
- The fine for not paying creates **urgency**, exactly the pressure phishing relies on.

It is a specialised case of the [overlay attack](/docs/security/qr-code-stickers-placed-over-real-ones):
a printed sticker pasted on the meter, the sign or the pay-and-display machine.

## The flow, step by step

1. The attacker prints stickers pointing at a payment page that imitates a real parking
   operator, and pastes them on meters and signage.
2. You scan, land on a page with the right logos and a plausible name, often reached
   through a [link shortener](/glossary/short-url) so the preview banner tells you nothing.
3. The page takes your registration number and card details, and usually confirms a
   "successful" payment.
4. Your card is charged, sold or reused. You also have no valid parking session, so a
   genuine fine may follow: the scam frequently costs twice.

## Rules for drivers

- **Prefer the official app or the machine itself.** If the sign names an operator, type
  its app name into your app store or use the meter's card slot. An app you install once
  beats a code you must trust every time.
- **Feel the code.** A sticker over the original has a raised edge.
- **Read the domain** on the preview banner before opening, the part immediately before
  the first single slash. The
  [checking routine](/docs/security/how-to-check-a-qr-code-before-opening) takes seconds.
- **Distrust shorteners and urgency.** A legitimate operator has no reason to hide its
  payment domain.
- **Never re-enter card details after a "payment failed" message**, a common variant
  harvests the card twice on the fake page.
- When in doubt, decode the code without opening it using a client-side
  [scanner](/scan), or skip the code entirely and pay another way.

## Rules for operators and councils

- Use [tamper-evident labels](/docs/security/tamper-evident-qr-labels) so removing the
  genuine code is visibly destructive.
- **Print the payment domain in plain text** on the sign, so drivers can compare it with
  the banner their phone shows.
- **Audit machines on a route schedule**: the attacker's window is the gap between your
  inspections.
- **Use one consistent, guessable domain** across every site. Ten different payment
  domains train drivers to accept anything.
- Consider whether a QR code is needed at all: an app name and a location code typed by
  the driver removes the attack surface completely, one honest case where
  [not using a QR code](/docs/basics/when-not-to-use-a-qr-code) is the stronger design.

## If you already paid on a fake page

Contact your bank immediately and ask them to block the card: do not wait for a charge to
appear. Report the sticker to the parking operator and the police. Keep the fake site's
address if you can; operators use it to get pages taken down. Then check whether a genuine
parking session exists, because you may still need to pay for one.

## FAQ

### Are QR codes on parking meters safe to use?
Treat them as unverified. Genuine operators do use them, but meters are the most-documented target for sticker fraud. Feel for an overlay edge, read the domain before opening, and prefer the operator's official app when you can.

### How do I know if a parking QR code is fake?
A raised sticker edge, a shortened link, a domain that does not match the operator printed on the sign, and urgency wording are the main tells. A page that asks for card details after a "failed" first attempt is a strong sign of fraud.

### What happens if I scanned a fake parking QR code?
Scanning alone did nothing. If you entered card details, contact your bank to block the card, report the sticker to the operator and police, and check whether you still owe for a genuine parking session.

### Why have some councils removed QR codes from parking machines?
Because repeated sticker fraud made the codes a net liability: drivers could not reliably tell real from fake. Those councils direct drivers to official apps or card payment at the machine instead.

## Try it

- https://useqr.app/scan
- https://useqr.app/validate