How to Spot a Fake Parking Meter QR Code

A fake parking meter QR code is usually a sticker placed on or near a meter or pay station, often right over the real code, that leads to a copycat payment page. To spot one, look for a sticker with raised edges or one covering printed text, then check that the scanned address belongs to your city or its known parking operator. The safest move is to skip the code and pay with the official parking app, the meter itself, or an address printed on the city’s own signage.

The FTC lists this exact trick in its warning about QR code scams: scammers cover up the real codes on parking meters with their own. You pay the scammer, the city never gets paid, and you may still get a ticket.

How does the parking meter QR code scam work? #

A scammer prints QR stickers that look like parking-payment codes, sometimes copying a city’s colors or the name of a real parking app.
The stickers go on meters, pay stations or parking signs, often on top of a genuine code or next to “pay by phone” instructions.
You scan it because you’re in a hurry and the meter says you can pay by phone.
You land on a copycat payment page that asks for your plate number, card details and sometimes more.
The scammer keeps your card details. Some fake pages charge a small fee to look legitimate, then use the card later.

Parking works well for scammers because people pay under time pressure, many cities genuinely use QR codes and phone payments, and a sticker on a city meter borrows the city’s trust.

Signs a parking QR code is fake #

On the meter or sign #

It’s a sticker. Run a finger over it. Raised edges, bubbles or a slightly crooked placement are warning signs.
It covers something. A sticker over printed text, over another code, or over part of the official instructions.
It doesn’t match the rest of the signage. Different fonts, colors or logo quality from the printed sign it sits on.
There’s no city or operator name, just “Scan to pay” with no brand you can check.
There are two codes in different styles. One of them is probably not supposed to be there.

After you scan #

The domain doesn’t belong to the city or the parking company. Read the web address before you open it. The real owner is the part just before the first single /, read from the right: pay.yourcity.gov is yourcity.gov, but yourcity.gov.parking-pay.net belongs to parking-pay.net.
It’s a shortened link (bit.ly, tinyurl.com and similar), which hides the real destination.
The page asks for too much. Parking needs your plate, zone and payment. It doesn’t need your date of birth, your Social Security number or your bank login.
It pushes you to download an app from a link instead of from the App Store or Google Play. The FBI advises getting apps only through your phone’s official app store.
There’s extra urgency, like a “final notice” or a fine to pay on the spot.

How to check a parking QR code before you pay #

Inspect the physical code first. The FBI tells people to check that a code hasn’t been tampered with, such as with a sticker on top of the original.
Scan it without opening it. Read the preview banner your camera shows, or use a scanner that shows the full contents first.
Compare the domain with the city’s official site or the parking app named on the printed sign.
If anything is off, don’t pay through the code. Use one of the safer options below.

QR Handler is useful at step 2. It never opens a code by itself. It shows the whole link on the result screen, names the real site behind it, and flags shortened links, unencrypted http, raw IP addresses and look-alike characters. For a shortened link, a Reveal destination button follows it to the final address, but only when you tap it. It can’t tell you whether cityparking-pay.com is the city’s real vendor or a scam site with a plausible name. The domain check is still yours to do.

Safer ways to pay for parking #

The official parking app, downloaded from the App Store or Google Play. Many cities print the app’s name and a zone number on their signs. Search the store for the app yourself instead of scanning.
The meter or pay station itself. Coins and card readers can’t redirect you to a fake site.
The address printed on official signage, typed into your browser. The FBI’s advice for payments is to type a known, trusted address instead of following a QR link.
The city’s website. Your city’s parking department page lists the approved apps and payment methods.
A saved favorite. If you park in the same city often, set up the official app once and use it every time. Then any code on a meter is irrelevant to you.

What to do if you paid through a fake parking QR code #

Call your card issuer using the number on the back of your card. Report the charge as fraud, ask for a new card, and dispute the payment. The FTC’s advice for scam victims starts with reporting it to the issuer right away.
Pay the real parking fee through the official app or meter if you’re still parked, so you don’t get a ticket on top of the loss.
Tell the city or parking operator exactly where the sticker is, so they can remove it and warn others.
Report it at ReportFraud.ftc.gov and ic3.gov.
Change passwords if the fake page asked you to sign in, and follow the fuller steps in what to do after scanning a malicious QR code.

Keep screenshots of the page, the charge and a photo of the sticker. They help with a card dispute and with contesting a ticket if one arrives.

Why cities can’t just remove every fake code #

Parking meters are spread across whole cities, stickers take seconds to apply, and a crew can’t check every meter every day. Some cities have responded by removing QR codes from meters altogether, moving to codes printed into the sign itself, or telling residents to use only the official app. Check your city’s parking page for what it currently recommends.

For a broader look at this kind of attack, including the email and package versions, see what quishing is, and for the general habit, our guide to checking a QR code before opening it.

Frequently asked questions #

Do real parking meters use QR codes? #

Many do. Cities and private lot operators use QR codes to link to their pay-by-phone service. That’s exactly why fake stickers work, so check who the code actually leads to rather than assuming every code is fake or real.

Can I get a parking ticket if I paid a fake site? #

Possibly. The city never received the payment, so its records show you as unpaid. If you get a ticket, contest it with your evidence: the photo of the sticker, the charge, and your report. How that’s handled depends on local rules.

How do I report a fake QR code on a parking meter? #

Contact your city’s parking or transportation department with the meter’s location or number, and a photo if you have one. Then report the scam to the FTC at ReportFraud.ftc.gov.

Is paying for parking by QR code ever safe? #

Yes, when the code genuinely comes from the city or its operator and leads to their real site. The risk is that you can’t easily tell from the sticker alone. Installing the official app once and using it every time avoids the question.