How can I tell a QR code has been tampered with?

Look at the sticker itself. A code placed over the real one is often slightly raised, has visible edges, or is printed on different material than the rest of the sign. When in doubt, use the agency's app instead.

Is it safe to scan any QR code I see in public?

Not automatically. A code in a place you would not normally look for a link is worth a second look before you scan it, and the page it opens is worth checking before you enter anything on it.

What if I already paid through the fake page?

Watch your card statement for charges you do not recognize and contact your card issuer if you see one. You can also report the page at ReportFraud.ftc.gov.

Scam alert

A QR Code on a Parking Meter May Not Be the Real One

Published September 12, 2026 · Arrives by a QR code sticker on a parking meter or sign

The short answer

Look closely at a parking meter's QR code before you scan it—a sticker placed over the real one is often slightly raised, crooked, or a different material than the sign around it. Pay through the parking agency's own app or a web address you type in yourself instead of the code on the meter, and check the address that opens before entering any payment details. Many meters also print a phone number or app name you can use instead of scanning anything.

What is happening

The Federal Trade Commission warned in September 2026 that people are finding scammers' own QR codes stuck directly over the real codes on parking meters and signs, and a Nashville television station covered the same pattern that month. Scanning the added code opens a look-alike payment page built to collect money or personal details rather than pay for parking.

How to recognize it

A QR code sticker looks raised, crooked, or made of a different material than the rest of the meter or sign.
The page that opens asks for more than a parking fee, or for personal details unrelated to payment.
The web address on the page does not match the parking agency's official app or site.
There is no phone number or app name printed on the meter to check the code against.

What to do instead

Check the QR code itself for signs it was placed over another one before scanning it.
Pay through the parking agency's own app, or a web address you type in yourself, rather than the code on the meter.
Read the web address that opens before entering any card details.
Use a phone number or short code printed on the meter as another way to pay, if one is offered.

If it already happened

Responding to one of these is common and understandable. These steps are what people usually take next.

Do not contact anyone through the site that opened—replying can be treated as a chance to ask for more.
Change the password on any account whose details you entered, especially if you reused it elsewhere.
Review your bank and card statements for charges you do not recognize.
Report it at ReportFraud.ftc.gov.

Open Help Now

Common questions

How can I tell a QR code has been tampered with?: Look at the sticker itself. A code placed over the real one is often slightly raised, has visible edges, or is printed on different material than the rest of the sign. When in doubt, use the agency's app instead.
Is it safe to scan any QR code I see in public?: Not automatically. A code in a place you would not normally look for a link is worth a second look before you scan it, and the page it opens is worth checking before you enter anything on it.
What if I already paid through the fake page?: Watch your card statement for charges you do not recognize and contact your card issuer if you see one. You can also report the page at ReportFraud.ftc.gov.

Practice this safely

Practice checking a code or link against a source you already trust before you scan or tap it.

Every story is fictional. There is no timer, no score, and no real message, payment, or account.

Start the four-story practice

Where this comes from

These links open the published sources in a new tab. The destination is shown before you open it.

Phishing emails

More recent alerts

This alert provides general educational information drawn from the sources above. It cannot determine whether a specific message you received is genuine, investigate an incident, or promise recovery or reimbursement.