You are already late, the parking meter says “scan to pay,” and you tap your phone to the little square without a second thought. That is exactly the moment the scam is built for. A crook peeled a fake sticker over the real code, your phone opened a convincing payment page, and the card number you just typed went straight to them. It is called quishing, it is climbing fast, and beating it takes about two seconds of attention.
QR code payment scams have spread from parking meters to fake “city notices,” restaurant tables, and event tickets, because a QR code hides its destination until you have already scanned it. That is the whole trick. Here is how the scam works, where it shows up, and the simple habits that keep your card details out of a scammer’s hands.
Quick Answer
QR code scams, or quishing, use fake codes to send you to lookalike payment or login pages that steal your card number or password. The classic version is a fake sticker placed over a real parking-meter code. To stay safe, inspect the code for a sticker pasted over another, check the web address after scanning for misspellings or odd domains, and never enter payment details on a page you reached only by scanning. When possible, pay through the official app or by typing the address yourself.
What Quishing Actually Is
Quishing is simply phishing delivered through a QR code instead of a link in an email. The reason it works is that a QR code is unreadable to you until your phone opens it, so you cannot see where it leads before you commit. By the time the page loads, you are already on the scammer’s turf.
The problem is growing quickly. The Federal Trade Commission has warned that scammers hide harmful links in QR codes, and reports of quishing have jumped sharply, including a large spike in early 2026. Because the codes appear in trusted, ordinary places, people scan them on autopilot, which is exactly what the scam relies on.
The Parking Meter Classic
The signature version is beautifully simple. A scammer prints a fake “scan to pay” sticker and presses it directly over the legitimate QR code on a parking meter or pay station. You scan, your phone opens a page that looks like the real parking service, you enter your card to pay for parking, and the details go to the crook while your car sits unpaid.
It has spread because it scales. The same trick appears as fake parking tickets tucked under a wiper with a QR code to “pay your fine,” phony flyers claiming to be city notices, and swapped codes on restaurant tables or event posters. Anywhere a QR code is expected and payment follows, the sticker scam can follow too.
The Red Flags Before You Scan
You can stop most of these at the physical code, before your phone ever opens anything. Give the code a two-second look.
- A sticker over a sticker. A code that is peeling, crooked, or clearly layered on top of another one is the biggest tell.
- A code where one should not be. An unexpected QR on a mailed letter, a flyer, a parking ticket, or an unsolicited email deserves suspicion.
- Pressure to hurry. “Scan now to avoid a fine” or a countdown is designed to stop you thinking.
- A cheap, generic printout. A flimsy paper code taped to an official-looking machine rarely belongs there.
The Checks After You Scan
If you do scan, the URL bar is your last and best line of defense, because the page cannot hide its real address. Before you type a single detail, read the web address carefully.
Look for misspellings and switched letters, since a domain can be off by one character and still look right at a glance, and be wary of a long string of random characters or a link shortener hiding the real destination. If the page immediately demands a card number, a login, or an app download, stop. A legitimate parking or payment service will have an official app or website you can reach without the sticker, so when in doubt, close the page and pay that way instead.
If You Already Scanned and Paid
Acting fast limits the damage, so do not wait to see what happens. Contact your bank or card issuer right away to report the charge and freeze or replace the card, since a quick call can stop further transactions and start a dispute.
Then lock down anything the page may have touched. Change the password on any account you entered, turn on stronger two-factor authentication, and watch your statements for unfamiliar charges. Report the scam so others are warned, using the FBI’s Internet Crime Complaint Center and the FTC. Reporting will not always recover the money, but it feeds the warnings that shut these schemes down.
What To Know
- Quishing is phishing via QR code; you cannot see where a code leads until your phone opens it, which is the whole trick.
- The classic scam is a fake “scan to pay” sticker placed over a real parking-meter code, sending you to a lookalike payment page.
- Before scanning, check for a sticker over a sticker, unexpected codes, and pressure to hurry.
- After scanning, read the URL for misspellings or odd domains, and never enter payment on a page reached only by scanning.
- Prefer the official app or typing the address yourself, and if you are caught out, call your bank fast and report it to the FTC and FBI.
Frequently Asked Questions
Can simply scanning a QR code hack my phone?
Scanning alone usually just opens a web address; the danger comes from what you do next, like entering a card number or password on the fake page it loads, or downloading an app it pushes. Modern phones show the link before opening it, so read that preview and do not proceed if the address looks wrong.
How do I know if a parking QR code is fake?
Inspect the physical code first. A sticker that is peeling, crooked, or layered over another code is the top warning sign. Then check the web address it opens for misspellings or an unofficial domain. When unsure, skip the code entirely and pay through the parking service’s official app or website.
Where else do QR code scams show up?
Beyond parking meters, common spots include fake parking tickets under a wiper, flyers posing as city notices, swapped codes on restaurant tables and event posters, and QR codes in unexpected emails or mailed letters. The pattern is a code in a trusted place followed by a request for payment or login.
What should I do if I entered my card on a fake QR page?
Call your bank or card issuer immediately to report it, freeze or replace the card, and dispute any charge. Change passwords for any account you logged into, enable stronger two-factor authentication, and monitor your statements. Report the scam to the FTC and the FBI’s IC3 so it can be tracked and others warned.
What To Do Next
QR codes are convenient precisely because they hide their destination, and that same convenience is what scammers borrow. The defense is a small, repeatable habit: glance at the code for a pasted-over sticker, read the address before you type anything, and pay through an official app when money is involved. Two seconds of doubt at the meter is a lot cheaper than a drained card and an unpaid parking fine. For more on staying safe, see our Law and Finance & Money sections.
This article is general consumer-safety information, not legal or financial advice. If you have been defrauded, contact your bank and report it to the appropriate authorities for guidance specific to your situation.