Fake QR codes on parking meters: how to spot one before you pay
Updated August 6, 2026
Before you scan anything on that meter, spend a minute on the city's own parking page and find out which vendor it contracts with. Passport, Flowbird, ParkMobile, PayByPhone, whichever. Some cities don't take QR payments at all, and that single fact settles the whole question standing at the curb. Here's why it matters. Every confirmed US case of this scam has run the same way: someone prints vinyl QR stickers, sticks them on public meters overnight, and points drivers at a lookalike payment page that takes your card number and never pays your parking. You get charged, and you still get the ticket.
The useful part is that the fake is a physical object. You can touch it. A real meter's graphics are silkscreened onto the faceplate or sit under a plastic window as a factory decal. The scam is a sticker on top of that. Run a thumbnail along the edge and most of them give themselves up in two seconds.
The sticker-over-sticker tell
Look at the code, then feel it. If it's raised, if a corner lifts, if there's an air bubble underneath, or if the white of the sticker doesn't match the white of the panel around it, it isn't the city's. In Asheville the first fake was caught by a parking employee on a routine coin collection who noticed a green QR sticker that just didn't belong on the meter.
Other things that give it away:
- It covers something. Fakes usually sit on top of the real instructions, the meter or space number, or the phone number for the city's pay-by-phone vendor.
- Print quality doesn't match. Glossy vinyl on a matte panel. A code noticeably sharper or blurrier than the text beside it.
- Square corners where every other label on the meter has the rounded corners of a factory decal, or a sticker set slightly crooked.
- Two codes on one meter. If there's a code printed into the faceplate and a second one stuck near it, treat the stuck one as hostile.
- Wording that's a little too eager. Raleigh's fakes read "Scan here to pay for parking," which is not how a municipal meter usually talks.
The strongest check happens before you ever reach the meter. A lot of cities don't use QR codes for parking at all. Asheville said plainly that it does not use QR codes on parking meters and never has. The New Orleans utility Entergy said the same thing about its public EV chargers. If the agency doesn't use them, then every code you see is fake by definition, and there's nothing to inspect.
If you want to know where a code leads without letting your phone open it, take a photo and run it through our QR code checker, which decodes the image in your browser and shows you the destination as plain text.
Where this has actually happened
This isn't hypothetical. The pattern started in Texas over the 2021 holidays and has resurfaced most years since.
- San Antonio, December 2021. More than 100 pay stations were stickered. San Antonio police alerted other Texas cities, which is how the rest caught it early.
- Austin, January 2022. Fake codes on 29 of the city's roughly 900 pay station kiosks, mostly downtown. The scam address was a near copy of the real payment processor's domain but ended in.xyz instead of.com.
- Houston, January 2022. Ten downtown meters, found after San Antonio and Austin passed the warning along.
- Redondo Beach, California, August 2024. Around 150 meters along the Esplanade and in Riviera Village. The stickers pointed to poybyphone.online, a typo of PayByPhone, one of the two vendors the city actually contracts with.
- Fort Lauderdale, November 2024. Fake stickers turned up in city parking garages, not only on street meters.
- Raleigh, North Carolina, New Year's Eve 2025 into January 2026. Stickers on downtown street meters and lots, with more found on January 5.
- Asheville, North Carolina, February 2026. Roughly 15 to 20 stickers pulled from meters on Biltmore Avenue, Coxe Avenue near the post office, Pack Square and South Market Street.
The FBI flagged the tactic in a public service announcement in January 2022 (alert I-011822-PSA) that named parking meters specifically, and the FTC published a consumer alert on hidden QR code links in December 2023 which uses the parking meter sticker as its main example. I couldn't confirm that anyone was ever charged in the Texas cases. As far as I can tell, the stickers get removed and the trail goes cold.
What the fake page actually collects
It looks like a parking payment screen, because that's the point. Typically it wants the zone or space number, your license plate, then card number, expiration, CVV and billing ZIP. Some versions ask for a phone number too, which is worth noticing: a phone number lets them send you something later.
What it doesn't do is pay your parking. That's the part people miss. The money goes to a processor the criminals control, the meter never registers a payment, and enforcement writes you a ticket while you're at lunch. You're out the card details and the fine.
Card numbers taken this way tend to get tested with a tiny charge, then run hard within a day or two. If you entered one, treat it as compromised right away instead of waiting to see what happens.
EV chargers are the newer target
Same trick, different metal box. In March 2026 Entergy warned drivers in New Orleans that several of its public chargers had stickers placed over the payment area telling people to scan to pay, and pointed out that it doesn't take payment by QR code at all. Drivers on other networks have reported unauthorized stickers labeled things like "payandzap" or "Authorized Guest Checkout" on chargers that never offered either.
Chargers work as a target for the same reason meters do. You're standing outside, mildly rushed, dealing with an unfamiliar machine, and you already expect a clunky payment flow. Nobody is surprised when a charger sends them to an ugly web page.
How to pay without scanning anything
Honestly, I'd skip QR codes for parking entirely, including the genuine ones. There's no version of scanning a public sticker that's safer than the alternatives, and the alternatives take about the same amount of time.
Pay at the meter with a card or coins if it takes them. Or install the parking app from the App Store or Google Play by searching its name, not by scanning anything, then type in the zone or space number. Raleigh uses Passport Parking. Asheville uses Flowbird, including a text-to-pay number printed on the meter. Redondo Beach contracts with ParkMobile and PayByPhone. Your city's transportation or parking page will name its vendor, and that page is worth two minutes before a trip somewhere unfamiliar.
If you do end up on a payment page, read the domain before you type. Look for the lookalike spellings and odd endings the real cases used. Nothing legitimate needs your Social Security number, a bank login, or a password to park a car.
If you already scanned one
Scanning by itself is not a disaster. A QR code is just a link, and opening a link doesn't hand over anything on its own. The damage comes from what you typed on the page that opened. Our page on what to do after scanning a scam QR code walks through the order of operations, but the short version is this: call your card issuer, ask for a new number rather than only a dispute, then watch the statement for small test charges.
Then report it, which genuinely helps, because cities pull these within hours once they know. Raleigh Parking takes reports at 919-996-3996. Asheville uses parking@ashevillenc.gov or (828) 259-5792. Redondo Beach police can be reached at (310) 379-2477. Entergy asked affected EV drivers to call 1-800-368-3749. If your city isn't listed, the number on the meter housing or the city's 311 line works. You can also file at reportfraud.ftc.gov and ic3.gov.
This same sticker logic shows up in other places. The codes printed on cards inside packages you never ordered run the identical play with a different cover story. And if you're wondering whether the code on your dinner table deserves the same suspicion, the answer is mostly no, for reasons I've set out in the piece on restaurant menu codes.
If you can peel it, don't pay it.