If you see a QR code stuck on a parking meter, do not scan it right away. The useful answer is simple: many people have reported scammers covering up legit QR codes on parking meters with a QR code of their own. Scanning that code could send you to a fake site built to steal your money, your personal information, or both.
This is a guide to the reported problem and to the checks that help before you pay, not a breaking-news bulletin. The evidence here comes from a consumer alert published on 2026-09-03 by the Federal Trade Commission (FTC). It describes a pattern people have reported and gives steps to protect yourself. It does not name specific cities, meters, payment apps, or dollar losses.
What is being reported, and what is not
The alert frames the issue as a payment convenience that scammers also like to use. Ever tried to pay for parking and discovered you need to scan a QR code to pay? That is the everyday setup the warning describes. Then comes the twist: scammers reportedly place their QR code over the legitimate one on a parking meter.
There is an important distinction here. What is established is that people have reported this covering-up behavior. What is not established is how often it happens, where it happens, or how much money it has cost. Those details are not in the alert. Treat the warning as a known scam pattern, not as evidence that any particular meter or posted code is compromised.
How the fake code is meant to work
The goal of the scanner is to move you from a meter to a payment screen. The goal of the scammer is to substitute that screen. If you scan the scammy QR code, it could take you to a fake site designed to steal your money, your personal information, or both.
So the risk is not the camera on your phone. It is the destination. That is why the most useful check happens after the scanner reads the code and before you tap through to the site.
A quick check before you pay
Many QR readers preview the link they will send you to. Use that preview. Make sure there are no spelling mistakes or switched letters in the link before you click. A small difference in the address is the kind of thing the preview exists to reveal. A fake payment address does not need to look wildly wrong; it only needs to look close enough while you are standing at a meter in a hurry.
Keep the pace slow enough to read the address. If the preview is confusing or the link does not look right, do not click. The alert does not tell you to test the code or to remove it. It tells you to check before you proceed.
Protecting the phone and the account
The alert also sets out a few maintenance steps. Update your phone's operating system (OS) and apps to help prevent scammy links from turning into a hack. That work is ordinary upkeep, not a guarantee that every fake site will be blocked.
For your online accounts, protect them with strong passwords and multi-factor authentication. Multi-factor authentication means a second step, such as a one-time code, beyond your password. It matters because a fake payment page may ask for credentials you also use somewhere else.
The alert links to Apple Support on updating an iPhone or iPad. That is a reading pointer in the original, not a claim that one update rule fixes this scam.
If you already scanned or paid
If you end up on a site that seems fake, do not reach out to anyone there to resolve it. If you reach out to someone through the website you think is fake, they may try to get money or sensitive information out of you. A legitimate help channel is not reached through a page you already suspect.
If you entered credentials like your username or password, change them immediately anywhere you use the same password for other accounts. Changing only one account can leave the rest exposed if the password was reused. Then review your transactions: check your credit card and bank statements to spot transactions you didn't make.
A short timeline for the moment it happens
| Stage | What to do | What the alert supports |
|---|---|---|
| At the meter, before scanning | Notice whether the posted code looks stuck on or covers another one | Reports describe legit codes being covered |
| After the scanner reads the code | Read the link preview for misspellings or switched letters | Many readers preview the link |
| Before you click | Stop if the address looks off | The concern is a fake site |
| If a page opens | Do not engage with anyone reached through it | The alert warns about contact through a fake site |
| If you entered credentials | Change the password wherever it was reused | The alert calls for immediate changes |
| Afterward | Review card and bank statements for unfamiliar transactions | The alert recommends a transaction review |
What the source does not say
The alert does not name a city, a parking operator, a payment app, or a specific meter. It does not say how many people reported the scam, and it does not give loss figures. It does not say whether the fake sites were taken down.
It also does not say all parking QR codes are unsafe. The report is about codes that have been covered by scammers, so the check is on the destination, not on the habit of scanning. And it does not promise that keeping your phone updated will catch every fake link.
Bottom line for readers
The check is small and fits in the seconds before a payment. Slow down when a code is parked somewhere, read the link preview, look for spelling mistakes or switched letters, and do not click if it looks wrong. If something goes through, change reused passwords and review your statements. The alert is about a reported scam pattern, not proof that the next meter you meet is compromised.