A QR code stuck on a parking meter is not proof that it belongs to the meter. The consumer alert behind this article describes a reported pattern: scammers covering up legitimate QR codes on parking meters with a QR code of their own (c03). The alert does not describe one specific confirmed incident, and this article does not add one.
The practical answer is short. Before you tap a scanned parking QR code, read the link preview, check the spelling, and confirm the destination looks like the city's or operator's real payment page. If you already entered credentials, change that password everywhere you reused it and review your statements (c11, c12).
What the alert actually describes
The starting point is a common, ordinary experience: needing to scan a QR code to pay for parking (c01). The alert frames this as convenient but notes that scammers like using QR codes too (c02). The reported method is physical and low-tech. Someone puts their own QR code over the legitimate one on the meter (c03).
What happens next is the risk mechanism the alert identifies. Scanning the scam QR code could take you to a fake site designed to steal your money, your personal information, or both (c04). That is the whole chain: a sticker, a redirect, and a page built to collect what you type.
Treat that as a described possibility, not a measurement. The alert does not report how many meters were affected, where, or when. It does not name a city, an operator, or a payment vendor. Nothing here establishes that any particular meter near you has been tampered with.
Check the link before you tap
The alert's first practical step is about previews. Many QR readers preview the link they will send you to before you open it (c06). Use that preview. Make sure there are no spelling mistakes or switched letters in the link before you click (c07).
Switched letters and small misspellings are exactly the kind of detail a preview is meant to surface. Read the domain slowly rather than scanning for a familiar word. A link that nearly matches a name you recognize deserves a second look.
The alert also recommends updating your phone's operating system and apps to help prevent scammy links from turning into a hack (c08). To be clear, and as the author's clarification rather than something the alert states: an update does not tell you whether a specific QR code is genuine. The alert does not address code verification directly, so do not read the update guidance as a check on the sticker itself.
If you already scanned and paid
The alert gives three steps for people who interacted with a page they think is fake.
- Do not engage the other side. If you reach out to someone through the website you think is fake, they may try to get money or sensitive information out of you (c10).
- Change the password. If you entered credentials such as a username or password, change them immediately wherever you use the same password for other accounts (c11).
- Review your transactions. Check your credit card and bank statements to spot transactions you did not make (c12).
Note the scope of the password step. The alert's instruction is about reuse: the same password on other accounts. It does not say how many accounts to check or how quickly a fraudulent charge would appear.
General protections the alert lists
The alert also recommends protecting online accounts with strong passwords and multi-factor authentication (c09). That is general account hygiene rather than a parking-specific fix, but it limits what a stolen password is worth to whoever collected it.
On the parking side, one piece of general practical advice, offered here as the author's own and not from the alert: if a preview looks wrong, stop and pay another way, or use a meter that takes card or coins. The alert does not discuss alternative payment methods.
A simple sequence to run at the meter
| Step | What to do | Basis |
|---|---|---|
| 1 | Look at the sticker itself before scanning, including whether it sits over another code | Author's practice suggestion; the alert describes covering, not how to spot it |
| 2 | Read the link preview in your QR reader | c06 |
| 3 | Check the link for misspellings or switched letters before clicking | c07 |
| 4 | If you clicked and entered a username or password, change it wherever reused | c11 |
| 5 | Review card and bank statements for transactions you did not make | c12 |
| 6 | Do not contact anyone through a site you think is fake | c10 |
The first row is the one the evidence does not cover. The alert explains the covering technique but offers no method for detecting a sticker on the hardware, so any visual check is the reader's own judgment call.
What the source does not say
- It does not report a specific confirmed incident, city, operator, or date for a covered meter (c03).
- It does not say how common the pattern is, or how many people have been affected (c02, c03).
- It does not describe what a fake parking payment page looks like, or list known fraudulent domains (c04).
- It does not say whether any payment service, city, or meter manufacturer has issued its own warning.
- It does not give a timeline for fraudulent charges to appear after a card number is entered (c12).
- It does not address alternative payment methods, refunds, or how to report a tampered meter.
What remains is a narrow, usable lesson. A QR code on a meter is an unverified claim about where your money goes. The preview and the spelling check are the two moments where you can catch it, and the password-change and statement review are what you do if you did not.