A sticker over a real parking meter, lot pay station, or street sign can send your phone to the scammer’s checkout, not the city’s. You tap, enter a card, and think you paid for two hours. The meter stays unpaid (ticket risk), and your card data is gone. This is distinct from SMS shipping-label QR cons covered in Fake shipping label and QR scams.
Broader map: Credit and debt scams. Login theft after a phished “parking” page: Phishing and account takeover.
How the parking QR overlay works
| What you see | What is happening |
|---|---|
| Fresh sticker on the meter, pole, or pay box | Covers the official ParkMobile / PayByPhone / city QR or URL |
| Short link or odd domain after scan | Harvests card, phone, plate, and sometimes wallet enrollment |
| “Pay here - meters cashless only” flyer | May be fake; real cities still publish official apps and meters |
| Tiny “convenience fee” then a second charge later | Card testing, then card-not-present fraud |
| Push to pay with gift cards or crypto “because the meter is down” | Irreversible extract (Gift cards and prepaid debit risks) |
Cities and private operators (ParkMobile, PayByPhone, Passport, SpotHero, and municipal apps) collect parking through their apps and posted URLs - not random bit.ly stickers.
Red flags on the curb
- QR sticker edges peeling, different gloss, or sitting on top of another code
- Domain is not the city site or a known parking app (lookalikes like
city-park-pay-secure.com) - Page asks for SSN, “refundable deposit,” or remote-access app install
- Pressure to use Apple Cash / Google Pay enrollment from a cold QR (wallet traps: Fake Apple Pay or Google Pay scams)
- Meter display still shows “expired” after you “paid” on the phishing page
Safer ways to pay
- Use the official city or operator app you installed from the real App Store / Play Store listing, opened from your home screen - not from a sticker.
- Type the URL printed on the meter metal (not the sticker) into the browser yourself.
- Pay at an attended booth, official kiosk screen, or with coins/card on the meter hardware when available.
- Prefer a credit card over debit for any digital parking fee you did intend to pay (stronger dispute path: Disputing a credit card charge).
- If a sticker looks wrong, peel carefully only if local rules allow reporting; photograph it and use the official app instead. Do not “test pay” on the suspicious QR.
Worked example
Avery parks downtown for a dentist visit. The meter has a bright new QR sticker over a faded official ParkMobile code. Avery almost scans, then notices the sticker corners and a URL that is not parkmobile.com or the city domain. Avery opens the ParkMobile app already on the phone, pays $4.50 for two hours, and sees the session active. Avery photos the overlay and emails the city’s parking contact from the official site. No card entered on the fake page; no ticket.
If Avery had paid on the phishing page, next steps would be: call the number on the card, freeze/replace the card, dispute unauthorized charges, change reused passwords, and report at ReportFraud.ftc.gov.
If you already scanned and paid
- Call the card issuer the same day; request a new number if the full PAN was entered.
- Dispute unrecognized charges; keep the meter location, time, and screenshots.
- Check whether a real parking session exists in the official app - if not, pay correctly there to avoid a ticket after securing the card.
- Change passwords if you also typed an email/password on the fake page (Phishing and account takeover).
- Report the location to the city parking authority and the FTC.
Checklist
- Inspect QR stickers for overlays before scanning at meters, lots, and EV street chargers.
- Pay only through official apps or URLs you type yourself.
- Reject gift-card or crypto “meter repair” pitches.
- Prefer credit cards for intentional digital parking fees.
- Photograph suspicious stickers and report them.
- If you entered a card on a bad page, contact the issuer the same day.
Educational only. Not legal or fraud-recovery advice. Parking vendors and city rules vary. Verify pay methods on official municipal or operator channels and report fraud to the FTC and your card issuer.