QR Code Parking Scams and the Quick Checks That Stop Them

You park, the meter says "scan to pay", and there is a neat QR code sticker right on the front. You scan it, a payment page loads with the council's colours and logo, and you type in your card number to pay 3.50 for an hour. Except the sticker was put there by someone else, the page was a copy, and your card details are now on their way to a stranger.

QR code parking scams have turned up on meters and pay stations in cities across Europe, North America and Australia, and they work because they look exactly like the real thing. The good news is that they are easy to beat once you know what to check. Here is how the scam works, the five second checks that catch it, and what to do if you have already paid.

How QR Code Parking Scams Work

The setup is cheap and fast. A scammer prints sticker QR codes linking to a fake payment site, walks along a street of meters early in the morning, and covers the genuine code or adds a new one beside the coin opening. The fake site usually asks for:

• Your vehicle registration, to make it feel official.
• Your full card number, expiry date and security code.
• Sometimes your email or phone number, which then gets used for follow up phishing.

Some versions go further and ask you to download an "official parking app", which can be malware. Others sign you up for a recurring "subscription" hidden in the small print.

This is phishing moved from your inbox to the street. The trick is the same one used in fake sites that copy a real one; only the delivery has changed.

Check the Sticker Before You Scan

Most fake codes can be spotted with your eyes before your phone ever opens a link.

1. Look at the edges. A sticker on top of another sticker, a slightly raised corner or a code that sits at an angle are all warning signs.
2. Compare with neighbouring meters. If one meter has a different sticker design from the five next to it, assume it is fake.
3. Read the printed instructions. Genuine signs often name an official app or a short web address. If the sign says to use a specific app and the QR code points somewhere else, trust the sign.
4. Feel for tampering. Run a thumb over the code. A genuine code is usually printed into the panel or under a protective layer, not stuck on top.

Read the Link Before It Opens

Most phone cameras show a preview of the web address before opening it. That preview is your best defence. Look for the exact domain of the council or the parking operator. Watch for small changes: extra words such as "pay" or "secure" added to the name, hyphens, misspellings, or unusual endings instead of the official one.

A short link that hides the real destination is another warning sign. Official operators rarely need link shorteners on their own meters. If you cannot tell where a code leads, do not open it.

Use the Official App or Website Instead

The safest move is simple: do not scan the meter at all. Most cities and private car parks use one or two named parking apps, and the zone number is printed on the sign. Install the official app from your phone's app store once, search by the operator's name rather than following a link, and pay by entering the zone number.

If you only park in a city occasionally, type the operator's website address yourself from the sign. It takes thirty seconds longer and cuts the risk to almost nothing.

Paying by card at the machine

Where the meter accepts contactless or coins directly, that is still safer than a QR code. The payment goes through the machine's own terminal, not an unknown website.

Why "Just Check for the Padlock" Is Not Enough

A lot of security advice still tells people to look for the padlock icon or "https" before entering card details. That advice is out of date for this kind of scam. Free certificates mean almost every fake site now shows a padlock too. The padlock only tells you the connection is encrypted. It says nothing about who is on the other end.

The same goes for "it looked professional". Copying a council's logo, colours and fonts takes minutes. What a scammer cannot easily fake is the domain name, so make that your main check. A quick refresher on how scam text messages work helps here too, because many parking scams follow up with a fake "unpaid fine" text a few days later.

If You Have Already Paid on a Fake Page

Act within the hour if you can. Speed matters more than anything else.

Remember that you probably have not paid for parking either. Pay through the official route so you do not get a real fine on top.

Protecting Customers If You Run a Car Park

Small businesses with car parks, such as cafes, gyms and clinics, can reduce the risk with a few habits. Print codes directly onto signs rather than using stickers, put tamper evident covers over them, and add the full official web address in large text under the code. Have someone walk past the signs weekly and check for anything that was not there before.

Frequently Asked Questions

Are QR code parking scams common?

They have been reported in many cities and tend to appear in waves, often in busy tourist areas or around stations. Treat every meter code with mild suspicion, even if you have used it before.

Can scanning a QR code alone infect my phone?

Scanning just reads a link. The harm comes from opening a malicious site, entering details, or installing an app. Checking the preview link before you tap it stops most of the risk.

Is it safe to scan QR codes on restaurant menus?

The risk is lower because a fake menu link has less to gain, but the same rule applies. If a code asks for card details or an app download, stop and use another way to pay.

Your Habit From Now On

Next time you park, skip the meter code entirely. Install the official parking app for the cities you visit most, add your vehicle once, and pay by zone number. If you must scan, check the sticker edges, read the link preview, and never enter card details on a domain you cannot confidently match to the operator on the sign. For more on scams like this, browse our threats guides.