Scammers are pasting their own QR codes over the real ones on parking meters

A QR code is a picture of text, and nothing inside the picture says who printed it. A phone camera reads the grid of black and white squares, decodes a string of characters, and in most payment cases opens the web address those characters spell out. Swap the grid and the destination changes with it, which is the entire mechanism behind scammers pasting their own QR codes over the real ones on parking meters.

The simplicity is deliberate. The format was built to be read quickly by any scanner, and a printed square on a sticker is as readable as one stamped into the meter by the manufacturer.

A grid that stores a string and vouches for nothing

DENSO WAVE, the company that developed the QR code, states on its standards page that it wants the format “used by as many people as possible,” and that it published the specification and waived patent rights for standardized versions. The code was approved as international standard ISO/IEC 18004 in June 2000. A single symbol can hold up to 7,089 numeric characters or 2,953 bytes of binary data, enough for a long web address with room to spare, and built-in error correction restores roughly 7% to 30% of damaged data depending on the level chosen.

Open generation is the point of the design, and it is also the weakness a parking scam exploits. Anyone can make a valid code for any address in seconds, and the standard has no field for proving that the person who printed it owns the meter it sits on.

A sticker as a complete attack

The FBI’s Internet Crime Complaint Center described the method in a January 2022 public service announcement: criminals tamper with QR codes by replacing legitimate codes with malicious ones. The notice lists three outcomes, which are redirecting a victim to a phishing site that captures credentials, delivering malware, and redirecting payments intended for a legitimate business to a criminal’s account. A parking meter combines the last two, because the driver arrives already intending to pay and already holding a phone.

The Manhattan District Attorney’s office announced an indictment in a case that shows the whole sequence. According to the office, a fraudulent QR code sticker was placed over the genuine payment code, and scanning it opened a fake website imitating the official ParkNYC platform that asked for credit card numbers, expiration dates, phone numbers, billing addresses and licence plate information. A victim near 79 East 10th Street scanned a sticker in June 2025 and noticed the fraudulent website, and a citywide canvass then found 64 fraudulent stickers on Manhattan meters. The defendant, a 39-year-old Brooklyn man named Mihai Theodor Enescu, was charged with five counts of identity theft in the second degree and six counts of criminal impersonation; the charges are allegations. District Attorney Alvin Bragg said: “New Yorkers should not have to worry that paying to park their car could end in identity theft.”

The preview check before anything opens

Phone cameras usually display the decoded address before opening it, and that pause is the only checkpoint in the chain. The Federal Trade Commission’s consumer alert on parking-meter codes, written by its Bureau of Consumer Protection staff, tells people to confirm that the link contains no spelling mistakes or switched letters before tapping it. A lookalike address built from transposed or swapped characters passes a glance but fails a slow read.

The FBI adds a physical check, which is to inspect a code for signs of tampering such as a sticker placed over another, and a payment habit: manually entering a known address for a transaction instead of scanning. For a sceptical driver, the FTC’s own consequence list is blunt. A scanned scam code, the alert says, could lead to a fake site designed to steal money, personal information, or both.

A city’s genuine payment path

Cities that run meters publish the channels they actually use, and the contrast is the best test. New York City’s Department of Transportation, quoted by NY1, said: “The only way to pay for metered parking in New York City is through the official ParkNYC app or on a physical ParkNYC parking meter.” DOT Commissioner Ydanis Rodriguez said in 2025 that anyone who sees a QR code on a parking meter should not scan it and should report it. The Manhattan DA’s office makes the same point, noting that the city does not ask drivers to scan QR codes to pay for parking.

The FTC’s advice for someone who has already scanned is to avoid contacting the scammer, change passwords immediately if credentials were entered, monitor bank and card statements, and report the code at ReportFraud.ftc.gov. In the Manhattan case, residents are asked to call 212-335-8900.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview