Scammers are pasting their own QR codes over the real ones on parking meters

The Federal Trade Commission’s Bureau of Consumer Protection warned in a September 3, 2026 consumer alert that scammers are covering legitimate QR codes on parking meters with codes of their own. A driver who scans the substitute lands on a website built to take money, personal information, or both. The advice that follows is brief, but each piece of it is worth reading closely.

“People have reported scammers covering up legit QR codes on parking meters with a QR code of their own,” the agency’s staff wrote in the alert. The warning rests on reports from people, and it describes a method rather than a single location.

A sticker on the meter becomes a payment trap

The mechanics are plain. A parking meter that invites payment by phone shows a QR code, and the driver points a camera at it rather than typing a web address. The FTC’s alert on QR codes on parking meters says the criminals simply cover the original with one of their own, so the printed square that looks official is the part an outsider has swapped.

What waits behind the fake code is, in the agency’s words, a site designed to steal money, personal information, or both. That covers two different harms. One is a payment taken directly, perhaps for parking that is never credited. The other is data handed over on a page that looks like a legitimate checkout, such as a name, a card number or a login that can be used later.

The one tell the FTC points to: the link itself

The alert gives a single concrete check. Many QR readers show a preview of the web address before opening it, and the FTC tells readers to make sure there are “no spelling mistakes or switched letters in the link” before clicking. A lookalike domain with a doubled letter or a swapped character is the kind of slip that survives a glance at a parking meter but not a slow read of the preview text.

That check costs a few seconds and needs no special software, which makes it the most practical defence on offer. It also puts the decision at the right moment, before the page loads and before any card number is typed. A driver in a hurry to feed a meter is the person least likely to read a web address carefully, which is the reason the FTC spells the step out instead of leaving it to instinct. The alert does not claim the check is foolproof, and it pairs the step with account-level protections described below, so that a missed typo does not decide the outcome on its own. Reading the preview, updating the phone and securing the accounts are presented as layers, each covering for the gaps in the others.

Phone updates, strong passwords and multi-factor authentication

Beyond the link check, the alert recommends keeping a phone’s operating system and apps up to date, and it points readers to Apple’s guidance on updating an iPhone or iPad and Google’s help page for checking and updating the Android version. Apple’s page describes going to Settings, then General, then Software Update, and says Apple recommends turning on automatic updates, which can install overnight while the device charges on Wi-Fi.

The alert also recommends strong passwords and multi-factor authentication on accounts. The FTC’s password guide advises aiming for roughly 12 or more characters, avoiding famous phrases that guessing tools could find, and never recycling a password across services. Its companion page explains that accounts with two-factor authentication require a credential from two of three categories to log in, drawn from something known, something held and something that is part of the person, such as a fingerprint.

The point of those two measures is damage control. If a fake page does capture a password, a second factor means the stolen password alone is not enough to open the account, and a unique password means one leak does not spill into other services. Neither step stops a bad scan from happening, but both limit what a scammer can do with whatever a victim typed in.

What to do after a bad scan, and where to report it

For anyone who thinks a bad code was scanned, the FTC’s instructions are specific. Do not contact the scammer. Change the password for any account whose details were entered on the page, and for any other account that reused it, then review bank and credit card statements for charges that do not belong. The reuse warning echoes the agency’s password guide, which tells readers who used the same or a similar password elsewhere to change it there too.

The alert closes by asking people to report the incident to the FTC, and the agency runs ReportFraud.ftc.gov for that purpose. Reports are how a warning like this one gets built in the first place: the alert’s own opening line credits people who reported the covered-up meter codes. A short report after an encounter, even one that ended without a loss, adds to the record that regulators and the public draw on.

The wider lesson from the FTC’s guidance is that a QR code carries no proof of where it came from. A sticker can be placed over another sticker in seconds, and the printed square gives no hint that it has been replaced. The agency’s answer is to treat the preview of the link, not the look of the meter, as the thing to trust, and to keep accounts protected so that one mistaken scan has limited consequences.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview