In short: A fake QR code scam is a con in which someone sticks their own QR code over the real one on a parking meter, a sign or a payment stand. Scanning it opens a lookalike payment page — the same logo, the same colours — built to collect your card details. It needs no phone call, because a sticker on a public machine looks like it belongs there. If you have already typed your card number into a page a code opened, call the number on the back of your card today and ask them to block it.
Quick Takeaways
- Look at the code before you scan it. Real codes are printed into the machine. A fake one is a sticker — fresh, slightly crooked, or lying on top of the label underneath. That sticker is the whole trick.
- Read the web address before you type a single number. The page copies the official logo, so the address is the only honest part of it.
- You never have to scan anything to pay. Pay at the machine, or open the official app you installed yourself from the app store.
In June 2025, a driver in Manhattan scanned a sticker on a parking meter on East 10th Street that read “Web Pay. Scan to Pay.” The page that opened carried the official ParkNYC logo and asked for his card number, expiry date, phone number, billing address and licence plate number. He tried to pay several times and the page just spun. Then he noticed the code was a sticker lying on top of the meter’s real ParkNYC label, and he called his banks before any money left his account. By the time prosecutors announced an indictment on September 30, 2026, the city had found 64 of those stickers on parking meters across Manhattan (Manhattan District Attorney’s Office). The FTC had warned about the same trick on September 3, 2026.
What this scam looks like
It arrives as a square. Most often it is a small sticker pressed onto a parking meter — in New York the fakes carried the same words as the real ones, “Web Pay. Scan to Pay.” Elsewhere they turn up taped to a payment sign on a post, or on the laminated card at a restaurant table where you scan to see the menu and pay the bill. It also arrives in your hand: a text about an unpaid parking fine or toll with a code and a deadline; a notice about a parcel that could not be delivered; a letter about a refund or a product recall you are owed.
The common thread is that the code does the work a person used to do: nobody has to call you and talk you into anything. You scan, a page looks like the real thing, and you type your card details because that is what you came to do. The FTC says the fake page is built to take your money, your personal information, or both.
How it works
- The sticker. Scammers print their own QR codes on ordinary blank label sheets — prosecutors say the Manhattan defendant bought two packs of 4-by-6-inch shipping labels — then press them over the genuine code somewhere busy, where people are in a hurry and pay by card. It takes a few seconds and works in any city.
- The lookalike page. The code opens a website that copies the real one: the same logo, the same colours, the same wording. On a phone screen there is nothing obviously wrong with it. That page asks for your card number, expiry date, phone number, billing address and licence plate number (Manhattan D.A., September 2026).
- The harvest. The page does not have to work for the scammer to win. One card number and its expiry date is enough to sell on, or to use somewhere else.
- The spinning screen. In the Manhattan case the page kept buffering while the victim tried again and again. A payment that never completes, or that errors after you press Pay, is not a glitch.
Why it works on people like you
This one is aimed at people who do things properly and pay their way. Nothing about it requires you to be careless.
Start with the sticker. We are taught, sensibly, that things attached to public equipment are official. A meter belongs to the city, so a code on it must have been put there by the city. Nobody expects a stranger to be printing payment labels and pressing them onto machines — and whoever does it is gone before the first scan.
Then notice what the scam does not need: a conversation. Most fraud requires someone to talk you out of your doubts. This one never speaks. There is no caller to distrust and no story to weigh up, so the moment when a careful person would normally grow suspicious never arrives.
You are also busy — on a sidewalk with the engine running, where thirty extra seconds to check a web address on your phone feels like making a fuss. That pressure comes from the situation, not from anything the scammer says.
And the one clue that would give it away is the hardest thing on the screen to see. You can judge the sticker with your own eyes, but the address bar is small grey type at the top of a phone, and nobody ever taught you to read it before typing. That is not gullibility. It is a habit no one handed you, on a screen designed by people half your age.
Last, there is independence. Asking a son or daughter to look at the phone can feel like admitting you could not manage it alone, and many older adults would rather work it out themselves than be managed. Scammers do not have to isolate you here — standing at a meter already does.
Red flags to watch for
- A QR code on a parking meter at all. New York City’s transport department says the only ways to pay for metered parking there are the official app or the meter itself, and asks people not to scan a code on a meter (NYC DOT advisory). Wherever you park, treat a code on the equipment as a reason to pay another way.
- A sticker where a sticker should not be. Genuine codes are printed into the metal or the plastic. A label you could peel off, or one code lying on top of another, is a fake.
- An address that is nearly right. Swapped letters, an extra hyphen, a strange ending. Officials urge people to check the link for misspellings or odd domains before entering anything (New York State Division of Consumer Protection, September 2026).
- A code in a text, email or letter with a deadline. A fine to pay today, a parcel to rescue, a refund to claim. Real organisations send you to their website by name.
- A page that wants more than the payment. Your bank login, your Social Security number, or an app to install before you can pay are all reasons to stop.
- A page that spins or errors. If the payment will not go through, close the page and stop typing.
What to do if it happens to you
- Scanned but typed nothing: close the page. Do not click anything on it, and do not reply to whoever sent it.
- Typed your card details: call the number on the back of your card today and ask them to block it and send a new one. Then check your statement.
- Typed a password: change it, and change it anywhere else you used the same one. Turn on two-step verification while you are there.
- Gave your bank login or read out a code: call your bank now and say exactly that. Speed matters more than anything else here.
- Report the sticker itself, so the next person does not fall for it. In New York that is ParkNYC on 1-800-428-4027; the city also asks people to tear the sticker off (NYC DOT).
- Tell one person you trust. The driver in the Manhattan case is the reason there is a case at all: he noticed, he checked, and he called his banks in time.
Where to report it
- ReportFraud.ftc.gov — the FTC, which is where the parking-meter warning came from.
- IC3.gov — the FBI’s Internet Crime Complaint Center, for the fraudulent website and any money lost.
- IdentityTheft.gov — if your card or personal details were used. It walks you through a recovery plan and a free credit freeze, step by step.
- AARP Fraud Watch Network Helpline — 877-908-3360, free, and you do not have to be a member. AARP’s Virginia office issued its own warning about fake QR codes in July 2026.
- The operator of the meter or car park — your city’s parking authority or the company named on the machine. Every report is one more sticker removed.
- Your state attorney general’s consumer protection office, which can act on local scams and local machines.
One thing to do this week: make the rule automatic, and say it out loud to the person who would otherwise be scanning for you. “I don’t scan codes in public. I pay at the machine, or I open the app I installed myself.” Then send this article to a friend who parks downtown, and to the adult child or caregiver who watches an older relative’s accounts — they are usually the ones who spot the first strange charge. For more on the tactics behind these pages, see our guides to phishing and tech scams and fake delivery and package fee scams.
