What This Scam Actually Looks Like
Scammers print their own QR code stickers and place them directly over real parking meter instructions. When unsuspecting drivers scan the code, they’re taken to a site that looks legitimate, but is anything but.
You pull up to a city parking meter, a parking sign, or a parking voucher machine and notice a prominently placed QR code. It may say “Pay for Parking Here” or have a similar message. Happy about the convenient payment method, you scan the code and pay using your email address and credit card number.
Victims face financial loss, potential identity theft, and can still get parking tickets or towing if their payment never reached the real parking authority. That means double trouble: losing money and facing fines.
The Term “Quishing” and Why It Matters
Quishing is a combination of “QR code” and “phishing,” a cyberattack where criminals embed malicious links inside seemingly innocent QR codes. The name is relatively new, but the tactic is becoming one of the fastest-growing forms of consumer fraud in the country.
QR code scams, known as “quishing,” are gaining traction as hackers lure consumers to fake websites to steal passwords and financial data. The appeal to cybercriminals lies in the relative ease with which the scam operates: slap a fake QR code sticker on a parking meter or a utility bill payment warning and rely on urgency to do the rest.
The structural problem is that QR codes are opaque to humans. You cannot read the URL until after scanning, and they bypass spam filters that inspect text-based URLs. That invisibility is precisely what makes them so effective as a tool for fraud.
Just How Widespread Is This Problem?
With quishing attacks up 587% since 2023, criminals are exploiting the trust people place in QR codes to steal credentials, payment details, and personal information. That is not a modest uptick. It represents a fundamental shift in how digital fraud is conducted.
The national fraud reporting centre Action Fraud received 1,386 reports of people being targeted last year, compared with 100 in 2019. Action Fraud statistics suggest a rapid growth in this kind of scam, with recorded incidents more than doubling in the UK between 2023 and 2024.
QR code phishing has surged in 2025 with average losses of about $1,225 per victim. For most people, that is a meaningful sum, not a minor inconvenience.
Cities That Have Already Been Hit
Documented cases have been confirmed in Austin TX, San Antonio TX, Houston TX, and Chicago IL, among others. In Austin alone, over 100 modified parking meters were reported in a single incident.
Fort Lauderdale issued warnings to visitors and residents about a parking payment scam involving stickers with fraudulent QR codes found on several parking meters and “Pay by Phone” signs throughout the city. The Better Business Bureau and the Federal Trade Commission have warned about the scheme nationwide.
In 2025 and 2026, fresh sticker campaigns were reported across Southern California, including Redondo Beach, where victims saw fraudulent charges within minutes, and as far as Toronto, where police warned of fake codes on parking metres in April 2026. The scam is not regional. It’s everywhere.
New York City Issues a Formal Alert
In June 2025, New York City Department of Transportation Commissioner Ydanis Rodriguez issued a consumer alert to notify New Yorkers about a parking meter scam targeting users of ParkNYC meters.
At least one fraudulent sticker with a QR code was illegally placed on the side of a meter to direct users to a third-party webpage asking for credit card information. The QR code is fraudulent, and users should not scan or share payment information through the link. The only way to pay for metered parking in New York City is through the official ParkNYC app or on a physical ParkNYC parking meter.
NYC DOT announced it would send in-app notifications to ParkNYC users about the scam and proper payment methods, notified law enforcement, and began a citywide inspection of all parking meters to remove any illegally placed messaging or markings.
The Fake URLs Are Almost Undetectable
In one California case, the scam URL was poi2park.com, designed to mimic a real parking site like pay2park.com. One small typo or odd word can mean the difference between legit and fake.
In Redondo Beach, California, about 150 parking meters were found with fake QR stickers. These were glued next to legitimate ParkMobile and PayByPhone labels. The bogus codes redirected users to a site named “poybyphone,” just one letter off the real name.
The stickers with the counterfeit QR codes may display the logo of a legitimate mobile app, such as Parkmobile, redirecting users to fraudulent websites that attempt to steal sensitive banking information. The attention to detail in these fakes is remarkable, and deeply unsettling.
Why Drivers Keep Falling for It
Today’s parking meters often require app payments or QR code scans. Busy drivers in a hurry aren’t likely to question a digital payment prompt, especially when it blends right in with city signage.
Researchers note that the crooks are relying on you being in a hurry and needing to do something quickly. Experts expect QR scams to increase as the use of QR codes spreads.
Scanning feels safe. People assume printed codes are vetted. That assumption is exactly what scammers are counting on, and it’s a reasonable one in almost every other context.
The Financial Damage Goes Beyond the Card Charge
The fraudster may use your info for identity theft, unauthorized purchases, or sell it on the dark web. Meanwhile, your parking remains unpaid. That second problem, the ticket or tow, can compound the frustration significantly.
Thieves often run a tiny transaction to confirm the card works before attempting something larger. Any unfamiliar amount, however small, is worth reporting.
In the UK alone, over £3.5 million has already been lost to QR scams in a single year. Comparable national figures for the US are difficult to pin down because the crime remains significantly underreported, according to fraud specialists.
How to Spot a Fake Before You Scan
Check for cheap-looking stickers or decals awkwardly placed over official signage. City-run meters usually have embedded instructions, not peeling stickers slapped on top. Always look for the city’s official parking website or payment provider listed somewhere on the meter.
If there is a QR code on the meter, look closely to ensure it is part of the sign and not just stuck on. If you have concerns or something doesn’t look right, do not use that QR code and go directly into the official parking app and enter the zone number.
The safest approach is to pay directly through official parking apps you download from the app store, not from a QR code on the meter. It takes a few extra seconds, but those seconds are a reasonable trade.
What to Do If You Already Scanned and Paid
If you think you scanned a fraudulent code, act in the first hour. Do not continue entering information. Close the browser tab, take screenshots of the page, domain, and sign, and note the exact location, meter number, or zone.
Contact your bank or card issuer using the number on the back of the card or the official app. Tell them the charge was tied to a fraudulent parking QR payment page and ask what protective steps they want on the account.
In the United States, victims may also report internet-enabled fraud to the FBI’s Internet Crime Complaint Center and payment card issues to the issuer’s fraud department. Also assume you have not actually paid for parking, and pay through a verified method so you don’t also end up with a citation on top of everything else.
The Bigger Picture: A Scam Built for Our Times
This scam works because it fits perfectly into how modern city life operates. QR codes replaced coins and card readers. Speed replaced scrutiny. Convenience replaced caution. Criminals read those trends before most drivers did.
Experts in the fraud space note that quishing is significantly under-reported and presents a “huge challenge” to authorities globally. That underreporting matters, because it means the real scale of the problem is likely larger than official numbers suggest.
As recently as February 2026, cities like Asheville were issuing fresh warnings about fake parking-meter QR stickers leading people to malicious sites designed to steal payment and card information. This is not a problem that peaked and faded. It’s still actively evolving, city by city, meter by meter.
Final Thoughts
The parking meter has always been a small, unglamorous friction point in daily life. Most people just want to park, pay, and move on. Scammers have bet heavily on exactly that impulse, and so far, the bet is paying off for them.
The good news is that awareness alone closes a large part of the gap. A two-second physical inspection of a QR code, a quick check of the URL, or a habit of downloading the official city parking app can stop this scam cold before it starts.
The broader shift in fraud tactics is worth noting, too. Criminals are no longer primarily targeting people who click suspicious email links. They’re targeting people standing on sidewalks, trying to do something completely ordinary. Staying alert in those mundane moments, not just online, is where the real protection starts.
AI Disclaimer: This article was created with the assistance of AI tools and reviewed by a human editor.