QR code scams: the code hides the destination, so check it
A QR code is just a web address you cannot read, and scammers exploit that invisibility. They stick their codes over genuine ones on parking meters, charging stations, and restaurant tables, sending payments to themselves, and they email QR codes that lead to credential-harvesting pages, partly because email filters cannot easily inspect an image. The scan itself is not dangerous; the page it opens and what you type there is where the harm happens.
Scan safely
- Preview the address before opening it. Most phone cameras show the link first or let you long-press to see it. Read the domain; a payment page for parking should belong to the city or the known parking app, not a random lookalike.
- Look for a sticker on top of a sticker. A code pasted over another, peeling, or mismatched with the meter's printed branding is a classic physical tell. Use the meter's own payment slot or the official app instead.
- Treat QR codes in unexpected emails as links from strangers, because that is what they are. A 'scan to verify your account' code from an email gets the same skepticism as any phishing link.
- Never enter banking credentials or card details on a page a random code opened, and never install an app a code suggests outside the official app stores.
- When paying for parking, prefer the official app you already have, or pay at the meter, over any code on a pole.
Where fake codes show up
- Parking meters and pay stations, the highest-volume version, harvesting 'parking payments' city by city.
- Restaurant tables and menus, redirecting payment or review pages.
- EV chargers and bike-share docks, anywhere a sticker fits and payment is expected.
- Emails and letters, 'quishing,' where the code dodges link scanning and lands on a phone with fewer protections.
- Crypto and payment contexts, where a code quietly substitutes the scammer's wallet address for the intended one.
Paid through a suspicious code or entered details? Call your card issuer immediately if card details were used, dispute the charge, and consider a replacement card. If you entered a password, change it from the official site and enable two-factor authentication. Report the location of a tampered meter to the city or operator, your report gets the sticker removed before the next driver scans it. Reports also belong at reportfraud.ftc.gov.
Common questions
Is scanning a QR code itself risky? The scan only decodes an address; phones do not execute code from a QR image. Risk begins when the opened page asks for logins, payments, or downloads. Checking the previewed address before proceeding removes most of the danger.
How do I know the real parking payment page? It matches the branding and domain printed on the meter itself or belongs to the parking app you installed from the official store. A mismatched, generic, or misspelled domain asking for full card details is the fake.
Related