A sticker no bigger than a coaster can stand in for a city’s payment system. The Federal Trade Commission’s consumer alert of Sept. 3, 2026, titled “See a QR code parked somewhere? Don’t scan it…yet!”, says scammers cover legitimate QR codes on parking meters with codes of their own. A driver who scans the substitute lands on a fraudulent site built to take money, personal information, or both.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The alert is credited to Bureau of Consumer Protection staff and says people have reported the substitution happening. Its advice runs in two directions: what to check before a scan, and what to do after one has gone wrong. Neither direction asks anyone to give up paying for parking by phone; both ask for a few seconds of attention at the moment when drivers are least inclined to give it. The warning also applies beyond the curb, wherever a printed code is stuck to a surface that a stranger could have reached.
A second code laid over the first
The trick is physical before it is digital. According to the FTC alert, the scammer does not need to breach a payment system or write a convincing app. A printed code is placed over the genuine one on the meter or sign, so the equipment appears exactly as the operator left it. The destination is the only thing that changes, and the phone’s camera cannot tell which square is original.
Parking is an ideal setting. A meter is a place where drivers pay under time pressure, often in poor weather, with a phone already in hand, and the whole interaction is designed to be quick. A code in the expected place gets no scrutiny. The fake page then collects what a payment page would ask for, and the alert warns that the loss can be money, personal information, or both.
The method is not new to the agency. A December 2023 consumer alert already named scammers placing their own QR code over legitimate ones, with parking meters as the example, and listed other routes for the same trick: a text or email claiming a failed package delivery, an account problem, or suspicious activity that needs a password change. The earlier alert noted that QR codes now appear on restaurant menus, parking payments, event tickets and boarding passes, and that the fake sites they open can capture any login details typed in or install malware that steals information. The September alert narrows the focus to the one place where the sticker is physically in the driver’s path.
Reading the link before it opens
The first protection the FTC gives is to inspect the web address before opening it. Many QR readers show a preview of the link, and the alert tells people to look for misspellings or swapped letters. A lookalike address often differs from the real one by a single character, which is easy to miss on a small screen but visible once someone slows down. The alert’s wording is “Don’t scan it,” and the word “yet” signals that the scan can proceed once the check is done.
The alert does not tell drivers to peel anything back or test the sticker, and it does not name any city, operator or parking app, so none can fairly be tied to the scheme. Still, the logic of the scam suggests a sensible additional habit: if a code looks like a separate sticker, sits crookedly, or does not match the signage on nearby meters, paying another way, or reading the address first, costs a few seconds. That inference is editorial rather than the agency’s instruction.
Updates, passwords and two-factor authentication
The second layer of defense is housekeeping on the phone. The alert says to keep the operating system and apps current so that a scam link is less likely to turn into a hack, and it links to the manufacturers’ instructions to update an iPhone or iPad and to check and update an Android version. It also recommends strong passwords and multi-factor authentication on online accounts.
The FTC’s guidance on creating strong passwords puts the target at no fewer than 12 characters, suggests passphrases made of random words rather than familiar phrases or song lyrics, and says passwords should never be reused. If a company reports a breach, the agency says to change the password at once and to change it on any other account that used the same or a similar one. The email account deserves the strongest password of all, the guide says, because reset links usually go there.
The agency’s explainer on two-factor authentication describes credentials drawn from two of three groups: something known, something held, and something that is part of the person. It ranks security keys as the strongest option, places authenticator apps ahead of codes sent by text or email, and notes that text codes are exposed to SIM card swaps. A verification code should never be shared with anyone who made the first contact.
Someone who has already scanned a suspect code is told to do four things. Do not contact the scammer through the fake site, since the page may be used to extract more money or information. Change passwords right away, starting with any that are reused elsewhere. Review credit card and bank statements for transactions that are not recognized. Then file a report with the FTC, which lets the agency see how often the same substitution turns up in different places.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
