Fake QR codes on parking meters: how to check before you scan and what to do if you paid

On September 3, 2026, the Federal Trade Commission warned drivers about a simple trick: people have reported scammers covering real QR codes on parking meters with codes of their own. Scan one, the FTC says, and you could land on a fake site built to take your money, your personal information or both. Here's how it looks, what to check first and what to do if you already scanned or paid.

What the scam looks like

The trick isn't new. The FBI warned about tampered QR codes in January 2022, the same month Houston's parking office said fraudulent codes had turned up on pay stations in San Antonio and Austin. New York City's Department of Transportation issued an alert in June 2025, and Asheville, North Carolina, said in February 2026 that staff had found about 20 stickers on city meters.

The New York case

The most detailed account comes from Manhattan. On September 30, 2026, the District Attorney and the city's Department of Investigation announced an indictment and said investigators had found 64 QR code stickers on Manhattan meters. They said the stickers led to a fraudulent site unconnected to ParkNYC, the city's approved parking app.

According to court documents cited in the announcement, one sticker read "Web Pay. Scan to Pay" and opened a page with the ParkNYC logo that asked for card details, a phone number, a billing address and a license plate. The person who reported it tried several times and kept hitting a loading screen, then noticed the code was a sticker on top of the official one and warned their banks before losing any money. The charges are allegations, the defendant is presumed innocent and the investigation continues.

Warning signs

• A sticker. The FBI says to check a physical code for tampering, such as a sticker on top of the original. NYC DOT described one stuck on the side of a meter.
• A familiar logo on the payment page. Prosecutors say the New York page displayed the official one, so a logo proves nothing.
• A page that keeps loading after you enter your details, as alleged in the New York case.
• Any QR code in a city that says it doesn't use them. Asheville says it doesn't use QR codes on meters, and New York's District Attorney says the city doesn't ask you to scan one when parking. Other parking systems may use them: the FTC's alert starts with drivers who find they need to scan to pay, so check what your city does.

How to check before you scan

1. Look closely at the code. If it's a sticker on top of another code or added to the side of the meter, don't scan it.
2. Find out how that city takes payment. Use its official parking web page, typing the address yourself. Asheville, for example, lists the meter itself, Flowbird's text-to-pay and the Flowbird app. New York City lists the ParkNYC app or a physical ParkNYC meter.
3. Skip the code if you can. If the meter or the official app can take your payment, you don't need the code. Get the app from your phone's app store: the FBI says not to download an app from a QR code.
4. If you do scan, read the link before you tap. The FTC says many QR readers preview the destination, so look for misspellings and switched letters. On an iPhone, the Camera shows a link at the bottom of the screen, and on a Pixel it shows a bubble or link; you tap it to open it. Other Android phones may differ.
5. Don't rely on a clean-looking link. The FBI advises avoiding payments on a site you reached from a QR code, and typing a known, trusted address instead.
6. Use the scanner you already have. The FBI warns that downloading a QR scanner app raises your malware risk, and says most phones have one built into the camera app.
7. Keep your phone and accounts protected. The FTC recommends updating your phone's operating system and apps, and using strong passwords and multi-factor authentication.

If you already scanned or paid

You scanned but didn't enter anything

Close the page and don't contact anyone through the site: the FTC warns that whoever answers may press you for money or sensitive details. The FTC and the FBI also say a malicious QR code could install or carry malware, so don't install anything the page offers, and keep your phone's software updated.

You entered card details or paid

1. Credit card: report it to the issuer immediately, using the number on the back of the card or the issuer's site or app, and, if you were charged, ask for your money back. The FTC notes that federal law protects you from unauthorized use.
2. Debit card: do the same with your bank or credit union. The FTC says federal law covers unauthorized debit card use too.
3. Payment app: report it to the app right away and ask it to reverse the payment and refund you.
4. Check your credit card and bank statements for transactions you didn't make.
5. Tell law enforcement. NYC DOT asks victims to notify their bank or card company, report the crime to law enforcement and report the meter's location.

A refund isn't guaranteed. The FBI says law enforcement can't guarantee recovery of lost funds, and the FTC says it's always worth asking the company you paid through.

You typed a password or other details

Change the password right away, along with any other account that uses the same one, and turn on two-factor authentication. If you gave your Social Security number and it was used, go to IdentityTheft.gov for a recovery plan. If it wasn't used or you aren't sure, the FTC points to IdentityTheft.gov/databreach.

Where to report it

• The FTC, at ReportFraud.ftc.gov.
• The FBI, if you lost money: your local field office and the Internet Crime Complaint Center at ic3.gov.
• Your city, so staff can inspect the meter. Look up the parking office on the city's official website. In New York City, call ParkNYC at 1-800-428-4027 or email parknyc@flowbirdapp.com. In Asheville, email parking@ashevillenc.gov or call (828) 259-5792.
• In Manhattan, the District Attorney's Office asks anyone who has run into a similar scheme to call 212-335-8900.

If the meter or the city's official app can take your payment, you don't need the QR code at all. When in doubt, skip the scan.