You pull into a parking spot, see a QR code on the meter that says “scan to pay,” and point your phone at it like you have a hundred times before. But that sticker may not belong to the meter — a scammer could have slapped their own on top, sending you to a fake payment page. This is quishing, and parking is a favorite spot for it. Our GetMyPassword team explains how to recognize a QR code parking scam.
How the scam works
Quishing is phishing through a QR code. A scammer prints a sticker with their own QR code and places it on a parking meter, pay station or EV charger, often right over the real one. You scan it expecting to pay for parking, and instead land on a convincing but fake payment page that captures your card details — or quietly signs you up for a charge. The code hides its destination, so you cannot tell by looking where it really goes. The genuine-looking spot is the disguise.
Red flags to watch for
- A sticker QR code applied on top of the meter, peeling, or slightly misaligned.
- A web address that looks off after scanning — not the official city or parking provider.
- An immediate request for card details on a page you reached by scanning.
- No official branding, or a domain that does not match the signage around the meter.
- Pressure to pay fast before you can check anything.
How to pay for parking safely
Treat a QR code as a suggestion, not an instruction. Check the preview URL your phone shows before opening it, and make sure it matches the official parking provider. Better yet, pay the way you know is real: the meter’s own card reader or coin slot, or the city’s official app downloaded from your app store rather than a code on a post. If a QR sticker looks added on or the page asks for card details on an unfamiliar site, do not enter anything.
A QR code on a meter hides where it sends you, and a sticker is trivial to fake. When in doubt, pay with the meter’s own reader or the official app — not a square someone could have stuck on.
How to protect yourself
Never enter card or login details on a page you reached by scanning a public QR code without checking the address first. If you already did, contact your bank, watch for fraudulent charges, and change any password you may have entered. Because these fake pages sometimes also fish for logins, keep your accounts behind a unique password from our password generator and two-factor authentication, so a scanned scam cannot turn into a stolen account.
Frequently asked questions
What is a QR code parking scam?
It is a quishing scam where a fraudster places a fake QR code sticker on a parking meter or pay station. Scanning it leads to a fake payment page that steals your card details instead of paying for parking.
How do I know a parking QR code is safe?
Check the preview URL your phone shows before opening it and confirm it matches the official parking provider, and look for a sticker applied on top or misaligned. When unsure, use the meter’s own card reader or the city’s official app instead.
What if I already paid through a fake QR code?
Contact your bank right away to flag the charge and protect your card, watch for further fraudulent activity, and change any password you may have entered. Enable two-factor authentication on accounts that could be affected.