Field guide · No. 13 · In person · Letter · Email

QR-code and parking-payment scams

The tell: A QR code on a meter, poster or letter sends you to a payment page that isn't the operator's.

https://park-pay-now.top/zone-4217

Check this example

How it works

  1. A sticker with a QR code is put over the genuine one on a parking meter or charging point, or a code is printed in a letter, email or poster.
  2. Scanning it opens a page that looks like the operator’s. It takes your card details and sometimes a one-time code.
  3. The charge is small, so you don’t notice. The card is used later.

QR codes hide the address they point to, so you can’t judge them by eye the way you can a link.

The tells

  • A sticker that sits on top of another one, or looks new on a worn meter.
  • The page address after scanning isn’t the operator’s own domain.
  • A page that asks for more than the payment: your full name, date of birth, a one-time code.
  • A QR code in an unexpected email or letter that says you must act now.

What to do

  • Use the operator’s official app, or type its web address yourself.
  • After scanning, read the address your phone shows before you enter anything.
  • Check the code isn’t a sticker. If it peels off, don’t use it.
  • If you’ve entered card details: call your card provider and ask for a replacement. If you’ve entered a password, change it.

Where to report it

Anywhere in the world
  • Your bank or card provider. First, if money or card details are involved. Use the number on your card.
  • The platform where it happened. Use its “Report” button: the marketplace, the messaging app, the social network.
  • Your local police. If you’ve lost money, and for a reference number your bank may ask for.
  • Your national fraud or consumer-protection agency. Search for it by country; use a government address (.gov or the equivalent).
United States

Links last checked 2026-10-12.

United Kingdom
  • Forward suspicious emails to report@phishing.gov.uk — Handled by the National Cyber Security Centre.
  • Forward suspicious texts to 7726 — Free. Your mobile provider receives the report.
  • Report Fraud (England and Wales) — If you’ve lost money or been hacked. Phone 0300 123 2040.

Links last checked 2026-10-12.

Canada

Links last checked 2026-10-12.

Australia
  • Scamwatch — Run by the national consumer regulator.

Links last checked 2026-10-12.