Nobody expects to get phished by a parking meter. Which is exactly why it works.
Here's the play: scammers print their own QR-code stickers and slap them over the real ones on meters and pay stations. You scan, you get a payment page that looks right, and everything you type — card number, bank login, maybe a password — goes straight to the scammer. Police recently reported a driver who lost $2,000 that way. One scan, at a meter, on an ordinary day.
There's a name for this now: quishing, as in QR phishing. And it's having a moment. The FBI calls it one of the fastest-growing phishing variants of the past two years and put out a public warning after scam stickers showed up on meters across Austin, Houston and San Antonio. New York City's transportation department went further — any QR code you find on its meters isn't a legitimate way to pay, full stop. The FTC has been flagging meter stickers since late 2023. The stickers didn't get the memo; they've only multiplied.
Why it keeps working
A QR code beats your best online instinct. With a sketchy email link, you can hover and see where it really goes. A QR code shows you nothing until you've scanned it — and by then there's a slick payment page in front of you and a parking clock in the back of your mind.
The setting does the rest of the work. You're at a meter. You're a little rushed. You came here specifically to pay. A "scan to pay" sticker reads as convenience, not attack. Phones make it worse: a link opened from the camera gets less suspicion — from you and from your phone's defenses — than the same link would in an inbox.
And this isn't small-time. Americans have reported over $4 billion lost to scams that move money through bank transfers and crypto. A card number typed into a fake meter page is fuel for that fire.
The defense costs nothing
Rule one: any QR code asking for money — parking meter, pay station, EV charger — is guilty until proven otherwise. Look before you scan. Is it a sticker sitting on top of another code? Peeling at the corner? Slapped on crooked? Cities print their codes into the signage; they don't hand-apply labels.
Rule two, and honestly the better one: don't scan at all. Use the city's official parking app. Pay at the kiosk. Type the URL from the official signage yourself. Thirty extra seconds, zero risk.
If a scanned page ever asks for more than payment — a password, a bank login, personal details — close it. That's not how parking works anywhere.
Already got burned? Move fast: call your bank or card issuer, dispute the charge, change any password you typed, and report it to the FTC and the city so someone peels that sticker off before the next driver finds it.
The bottom line
QR codes earned our trust in 2020 and never had to renew it. Scammers are cashing that trust in, one parking spot at a time. Beating them takes no software and no money — just the assumption that the sticker is lying, and the habit of paying through something you chose instead of something that was waiting for you.
Image: Robert So, via Pexels
