Parking QR code scams — how they work and how to avoid them

Why parking is the perfect target

Parking QR scams are the best-documented class of QR fraud, with public warnings from the FTC, the FBI and local authorities on both sides of the Atlantic — and some UK councils have stopped putting QR codes on parking machines altogether because of it. The conditions are ideal for an attacker:

• The victim is in a hurry and expects to pay a stranger's machine.
• The machine is unattended, so a sticker sits unnoticed for days.
• Entering card details on an unfamiliar website feels normal here, because dozens of legitimate parking operators each use their own payment domain.
• The fine for not paying creates urgency — exactly the pressure phishing relies on.

It is a specialised case of the overlay attack: a printed sticker pasted on the meter, the sign or the pay-and-display machine.

The flow, step by step

1. The attacker prints stickers pointing at a payment page that imitates a real parking operator, and pastes them on meters and signage.
2. You scan, land on a page with the right logos and a plausible name — often reached through a link shortener so the preview banner tells you nothing.
3. The page takes your registration number and card details, and usually confirms a "successful" payment.
4. Your card is charged, sold or reused. You also have no valid parking session, so a genuine fine may follow — the scam frequently costs twice.

Rules for drivers

• Prefer the official app or the machine itself. If the sign names an operator, type its app name into your app store or use the meter's card slot. An app you install once beats a code you must trust every time.
• Feel the code. A sticker over the original has a raised edge.
• Read the domain on the preview banner before opening — the part immediately before the first single slash. The checking routine takes seconds.
• Distrust shorteners and urgency. A legitimate operator has no reason to hide its payment domain.
• Never re-enter card details after a "payment failed" message — a common variant harvests the card twice on the fake page.
• When in doubt, decode the code without opening it using a client-side scanner, or skip the code entirely and pay another way.

Rules for operators and councils

• Use tamper-evident labels so removing the genuine code is visibly destructive.
• Print the payment domain in plain text on the sign, so drivers can compare it with the banner their phone shows.
• Audit machines on a route schedule — the attacker's window is the gap between your inspections.
• Use one consistent, guessable domain across every site. Ten different payment domains train drivers to accept anything.
• Consider whether a QR code is needed at all: an app name and a location code typed by the driver removes the attack surface completely — one honest case where not using a QR code is the stronger design.

If you already paid on a fake page

Contact your bank immediately and ask them to block the card — do not wait for a charge to appear. Report the sticker to the parking operator and the police. Keep the fake site's address if you can; operators use it to get pages taken down. Then check whether a genuine parking session exists, because you may still need to pay for one.

FAQ

Are QR codes on parking meters safe to use?

Treat them as unverified. Genuine operators do use them, but meters are the most-documented target for sticker fraud. Feel for an overlay edge, read the domain before opening, and prefer the operator's official app when you can.

How do I know if a parking QR code is fake?

A raised sticker edge, a shortened link, a domain that does not match the operator printed on the sign, and urgency wording are the main tells. A page that asks for card details after a "failed" first attempt is a strong sign of fraud.

What happens if I scanned a fake parking QR code?

Scanning alone did nothing. If you entered card details, contact your bank to block the card, report the sticker to the operator and police, and check whether you still owe for a genuine parking session.

Why have some councils removed QR codes from parking machines?

Because repeated sticker fraud made the codes a net liability — drivers could not reliably tell real from fake. Those councils direct drivers to official apps or card payment at the machine instead.