QR codes have made parking payments faster and more convenient. Instead of entering a long website address, drivers can simply scan a code with their smartphones and proceed to a payment page.
However, scammers can take advantage of this convenience.
A QR code parking scam occurs when criminals place a fraudulent QR code over or near a legitimate parking payment code. The fraudulent code may send drivers to a fake website designed to collect payment details, login credentials, or other personal information.
The FBI has previously warned that criminals can tamper with QR codes and use them to redirect people to malicious websites and fake payment portals.
This type of QR-code phishing is sometimes called quishing, short for QR-code phishing.
What Is a QR Code Parking Scam?
A QR code parking scam is a form of online fraud involving a QR code used for parking payments.
For example, a driver may arrive at a parking location and notice a QR code displayed on a parking meter or sign. The driver scans the code expecting to reach the official parking payment service.
If a scammer has replaced or covered the legitimate QR code, however, the driver could instead be redirected to a fraudulent website.
The fake website may imitate the appearance of the legitimate parking service and request information such as:
- Name and contact information
- Vehicle or license-plate information
- Credit or debit card details
- Email address
- Passwords or account credentials
The FBI warns that malicious QR codes can be used to direct people to fraudulent websites, collect sensitive information, or potentially expose devices to malicious software.
How the Fake Parking QR Code Scam Works
The scam can be relatively simple.
1. A fraudulent QR code is placed at a parking location
A scammer may attach a sticker containing a different QR code to a parking meter or sign.
In some cases, the fraudulent code can appear to be part of the original parking equipment.
2. A driver scans the code
The driver scans the QR code because they believe it is the official method for paying for parking.
3. The code opens a website
Instead of reaching the legitimate parking provider, the QR code may redirect the driver to a website controlled by the scammer.
The page may be designed to look similar to the legitimate service.
4. The website requests information
The fraudulent page may ask the driver to provide payment or personal information.
This can make the scam particularly convincing because the victim believes they are simply completing an ordinary parking transaction.
5. The information may be misused
Information submitted to a fraudulent website could potentially be used for unauthorized transactions, phishing attempts, account compromise, or identity-related fraud.
Warning Signs of a Fake Parking QR Code
Drivers should look for several warning signs before using a QR code to make a parking payment.
A QR code appears to have been placed over another code
Inspect the parking meter or sign carefully.
If the QR code looks like a recently applied sticker or appears to cover another QR code, consider using another payment method.
The FBI has specifically warned that criminals may physically place fraudulent QR codes over legitimate ones.
The website address looks unusual
Always check the web address after scanning a QR code.
Be cautious if the address:
- Contains spelling mistakes
- Uses an unfamiliar domain
- Contains unexpected words or characters
- Does not appear to belong to the parking operator
- Redirects through several unfamiliar websites
A professional-looking website does not necessarily mean that it is legitimate.
The page asks for unnecessary information
A parking payment should not automatically require unrelated sensitive information.
Be cautious if a page asks for passwords, account recovery information, or other details that do not appear necessary for the transaction.
The website contains obvious errors
Poor spelling, strange formatting, broken images, inconsistent logos, or unusual wording can be warning signs.
However, scammers can create convincing websites too, so good design alone should not be treated as proof that a website is legitimate.
The payment request seems unusual
Be especially careful if the page suddenly requests an unexpected fee or directs you to an unfamiliar payment method.
How to Avoid a QR Code Parking Scam
1. Inspect the QR code before scanning
Look carefully at the physical parking meter or sign.
If something looks tampered with, do not scan the code.
2. Check the destination before paying
After scanning, look at the website address before entering payment information.
The FBI recommends carefully examining URLs and being cautious about links that direct you to unfamiliar websites.
3. Use the official parking application
If the parking company provides an official mobile application, consider accessing it through your normal app store rather than downloading an application from an unfamiliar QR-code website.
4. Visit the official website manually
Instead of relying entirely on the QR code, you can type the parking provider’s known website address into your browser.
This reduces the risk of being redirected through a fraudulent QR code.
5. Use another payment method if something looks suspicious
If a QR code appears damaged, covered, or altered, look for another legitimate payment option.
If necessary, contact the parking operator using contact information obtained independently.
6. Keep your phone and apps updated
Keeping your device’s operating system and applications updated is an important part of maintaining basic digital security.
What If You Already Scanned a Suspicious QR Code?
Scanning a suspicious QR code does not automatically mean that your device or accounts have been compromised.
What happens next depends on what you did after scanning it.
If you only scanned the code
If you opened the website but did not provide information, download anything, or grant unusual permissions, close the page and avoid interacting with it further.
If you entered a password
Change the password immediately.
If you used the same password on other accounts, change those passwords as well.
The FBI recommends changing passwords when sensitive credentials may have been exposed through a fraudulent website.
If you entered card or banking information
Contact your bank or card provider promptly.
Explain that you may have entered your information on a fraudulent website and ask what steps they recommend.
Monitor your account for transactions you do not recognize.
If you downloaded an unfamiliar application
Do not continue using an application you believe may be unsafe.
Review the applications installed on your phone and remove anything you do not recognize or no longer need. You should also review permissions granted to unfamiliar applications.
Report the incident
If you are in the United States and believe you have been the victim of an online scam, you can report it to the FBI’s Internet Crime Complaint Center (IC3). The FBI recommends reporting online scams and internet-enabled crimes as soon as possible.
Why QR Code Scams Are Becoming a Security Concern
QR codes themselves are not inherently dangerous. They are simply a convenient way of directing a smartphone to a website, payment page, application, or other digital resource.
The security concern is that criminals can manipulate where a QR code sends you.
The FBI has described QR-code phishing, or quishing, as a technique in which malicious URLs are embedded in QR codes. In a 2026 advisory, the FBI also described malicious QR codes being used in targeted phishing campaigns.
For this reason, users should treat QR codes in much the same way they treat links in emails and text messages: verify the destination before providing sensitive information.
QR Code Parking Scam Prevention Checklist
Before making a parking payment through a QR code:
- Inspect the physical QR code.
- Look for signs that it has been covered or replaced.
- Check the website address after scanning.
- Confirm that the website belongs to the legitimate parking operator.
- Avoid entering unnecessary personal information.
- Never provide passwords simply because a QR-code website requests them.
- Consider using the official parking app or website.
- Use another payment method if the QR code appears suspicious.
- Contact your bank promptly if you entered financial information into a fraudulent website.
Frequently Asked Questions
Can parking QR codes be fake?
Yes. Criminals can place fraudulent QR codes over legitimate codes. The FBI has warned about this type of QR-code tampering.
What is quishing?
Quishing is a form of phishing that uses QR codes to direct people to malicious or fraudulent websites.
Can a QR code steal my money?
A QR code itself does not automatically steal money. However, a malicious QR code can redirect you to a fraudulent payment website where scammers may attempt to obtain your financial information or persuade you to make a payment.
How can I check a parking QR code?
Inspect the physical code for signs of tampering and check the website address before entering any information. If you are unsure, use the parking operator’s official website or another verified payment method.
What should I do if I entered my card details on a fake parking website?
Contact your bank or card issuer as soon as possible, explain what happened, and monitor your account for suspicious transactions.
Are QR codes safe to use?
QR codes are widely used for legitimate purposes and are not inherently unsafe. The important issue is verifying where a QR code takes you before interacting with the destination website.
Final Verdict
The QR code parking scam is a legitimate form of fraud that drivers should be aware of.
The biggest warning sign is not the QR code itself but the possibility that a legitimate code has been replaced or that scanning it leads to an unverified website.
Before making a parking payment, take a few seconds to inspect the code, verify the destination website, and use an official payment method whenever possible.
Being cautious does not mean avoiding QR codes altogether. It simply means checking the destination before trusting the transaction.
Useful Official Resources
For additional information about QR-code security and online fraud, readers can consult:
- FBI: Building a Digital Defense Against QR Code Scams
- FBI: Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes
- FBI: Spoofing and Phishing
- FBI Internet Crime Complaint Center (IC3)
- FBI: Common Frauds and Scams
