QR code scams: fake codes on parking meters, packages and in emails, and how to check one

What's happened

QR codes are now everywhere, from restaurant menus to parking meters, and scammers are using that. A QR code is just a web link you can't read, so a fake one can send you to a payment page or login screen that looks real.

On September 3, 2026, the Federal Trade Commission warned that "people have reported scammers covering up legit QR codes on parking meters with a QR code of their own." In February 2026, the City of Asheville, North Carolina, removed fake QR stickers from meters on Biltmore Avenue that led to a fake parking site asking for card details.

The FTC has flagged other versions this year. In April, it reported a spike in texts made to look like traffic court notices, with a QR code to "pay a fine." In August, it warned about brushing scams, where an unordered package includes a note with a QR code to find out who sent it. The FBI warned about the same package trick in a public service announcement in July 2025.

Who's affected

Anyone with a smartphone. Fake codes on meters catch drivers in a hurry. Codes sent by email, sometimes called "quishing," work the same way as a phishing link. The FTC says scam emails and texts make up a reason to scan, such as a missed delivery or a problem with your account.

Scanning can take you to a fake site that captures whatever you type, such as card numbers or passwords. The FTC and FBI both warn a code could also lead you to download malware.

What it means in dollars: a worked example

This is an illustration, not a real case.

Dana scans a sticker on a meter that says "Scan to pay." The page looks like a parking app and charges her $4.50. She thinks nothing of it until her card is hit with $380 of charges a few days later. She also still gets a $45 parking ticket, because the real meter was never paid.

Because she used a credit card, federal law caps her liability for unauthorized charges at $50, and many card issuers charge nothing. The parking ticket is a separate matter for the city, so it's worth reporting the fake code and asking how they handle tickets tied to it.

What to do now

1. Look before you scan. The FBI says to check physical codes for signs of tampering, such as a sticker placed over the original.
2. Check the link your phone shows you. Most phone cameras preview the web address. Look for misspellings, swapped letters or a domain that isn't the city's or company's real one.
3. Pay by another route when you can. Use the parking app, text-to-pay number or meter you already know, or type the company's web address yourself. The FBI advises against paying through a link from a QR code.
4. Don't scan codes you didn't expect. That includes codes in unexpected emails, texts and packages. If a message says there's a problem, contact the company using details you already have.
5. Don't download apps from a QR code. Get them from your phone's app store, and keep your phone updated.

If you've already scanned one

• Entered card details? Call your bank or card company, cancel the card and check your statements for charges you didn't make.
• Entered a password? Change it right away, along with any account where you used the same one, and turn on two-step verification.
• Report it to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov. For a fake code on a meter, tell the city or local police so they can remove it.

FAQs

Are QR codes on parking meters ever real?

Yes. Some cities use them. The difference is that a real one is usually printed on the meter or its official signs, not stuck on top. If in doubt, use the city's official app or the meter itself.

Do I have to pay for a package I didn't order?

No. The FTC says you don't need to return or pay for things you didn't order. Don't scan any QR code that comes with it, and if it came through Amazon or another marketplace, tell the platform.

What about QR codes for paying bills?

Be careful. The FTC says scammers push payment methods that are hard to reverse, including by QR code, and real utility companies won't demand payment that way.

Sources: FTC: see a QR code parked somewhere? Don't scan it yet (September 3, 2026), FTC: brushing scams (August 20, 2026), FTC: traffic violation texts (April 14, 2026), FTC: scammers hide harmful links in QR codes, FTC: barcode payment demands, FBI: unsolicited packages containing QR codes (July 31, 2025), FBI IC3: cybercriminals tampering with QR codes, FOX Carolina: Asheville warns of fake QR stickers (February 25, 2026)