QR code scams: parking meters, menus and fake payments
A QR code scam replaces or imitates a genuine QR code so that scanning it opens a fake payment or login page. The most visible version is a sticker placed over the code on a parking meter; the more common one for businesses is a QR code inside an email. The UK’s NCSC considers this fraud relatively small compared with other types, but easy to avoid with a few checks.
How QR code scams work and how to check a code
A QR code is just a link you cannot read. Scammers exploit that in two ways: they stick their own code over a genuine one in a public place, or they put a code in an email or a parcel, knowing it will be scanned on a phone with fewer protections. Before you scan, ask whether you expected a code here; after you scan, read the web address before you type anything. QR codes are one more channel among the scams by email, text, and phone, and the NCSC’s assessment of the real risk is a useful antidote to alarm.
How common it is
The NCSC wrote in 2024 that QR code fraud is relatively small compared with other types of cyber fraud, concentrated in open public places such as stations and car parks, and on the rise in email, where it is sometimes called “quishing.” It is not a reason to stop using QR codes; it is a reason to treat the ones you did not expect with the same caution as a link.
Parking meters
This is the version most people meet. A sticker with a QR code is placed on a parking machine, leading to a page that takes your card details or charges you for nothing. The FTC published an alert about it on September 3, 2026. In Canada, the City of Mississauga removed about 80 fake stickers from downtown parking machines in under an hour on April 22, 2026, and its notice mentions similar scams reported in Vancouver, Montreal, Ottawa, and Toronto. The city added that its own parking machines never use QR codes for payment.
The rule is simple: pay through the machine’s screen or through the app named on the official parking signs, never through a code stuck on the machine.
QR codes in emails
For a business, the more likely encounter is an email asking you to scan a code: to “confirm your account,” “review a document,” or “re-enable two-factor authentication.” The NCSC explains why this works for scammers: the link is hidden in an image that some email filters do not inspect, and the code tends to be scanned on a personal phone, outside the company’s protections. It advises caution with QR codes received by email.
Unexpected parcels and printed codes
The FBI warned in July 2025 about unsolicited parcels containing a QR code, often with no sender, leading to forms that collect personal or financial information or to malicious software. Its earlier warning, from 2022, already described criminals tampering with both digital and physical codes.
How to check a code before you trust it
- Did you expect it? A code in an email, a text, or a parcel you did not ask for gets no scan.
- Look at the code itself. The FBI suggests checking for a sticker placed over a genuine code.
- Read the address preview. Most phone cameras show the web address before opening it. The FTC advises looking for misspellings or switched letters.
- Do not install apps from a code. The FBI advises downloading apps only from your phone’s official store.
- Type the address yourself when you can. For a payment, open the official app or website rather than following the code.
If you scanned and paid
Change any password you typed on the page, check your bank statements, and call your bank if you entered card details. Report the scam: the FTC directs US readers to ReportFraud.ftc.gov, and the NCSC accepts screenshots of scam QR codes at report@phishing.gov.uk. Our page on where to report a scam in each country lists the other channels.
The same reflexes as for any phishing email
A QR code in an email is a phishing link in disguise. The checks in our guide to spotting a phishing email apply in full.