A convenient link still needs checking
A QR code can take your phone to a website, but its position on a machine does not establish who put it there. The US Federal Trade Commission warns that scammers have covered genuine parking-meter codes with replacements leading to fraudulent pages. This is an information guide to that method, not a report of a newly discovered incident in your city. The useful question is whether the destination belongs to the operator you intended to pay.
A documented example, with a local limit
On June 6, 2025, New York City’s Department of Transportation reported at least one fraudulent QR sticker on a ParkNYC meter. It directed people to a third-party page requesting card information. The department said the official app and physical meters were the payment routes for that system. That dated advisory illustrates why a sticker deserves scrutiny; it does not establish that every parking operator worldwide rejects QR payments or that the same sticker remains in place today.
Inspect the destination before opening it
The FTC advises reading the link preview and checking for misspellings or substituted letters before following it. The Social Security Administration also advises inspecting codes for tampering and verifying their source. A sticker that appears to cover another label is a reason to pause. When uncertain, independently establish the operator’s official payment route rather than treating the scanned page’s own branding as proof. A familiar logo and a demand for payment are not independent confirmation of the recipient.
Urgency can move the same trick off the street
The SSA describes imposter codes arriving through delivery messages, account warnings and advertisements. Its own rule is explicit: Social Security does not request payment using QR codes. That statement applies to the US agency; it is not a rule about every legitimate organisation. An unexpected message claiming an urgent problem should be checked through a separately established contact route. Moving from a suspicious message to its linked payment page does not verify the original claim.
After a suspicious scan, consider what you actually shared
The FTC advises against contacting a suspected scammer through the questionable website. If you entered a password, change it wherever that same password is used, and review transactions for unfamiliar activity. For the parking scam it described, NYC DOT advised contacting the bank or card company about exposed payment information. Keep the distinction clear when seeking help: opening a page, entering credentials and submitting card details describe different actions. Tell the legitimate provider what happened without sending more information to the suspect site.
Use the guidance in the right jurisdiction
The FTC accepts US fraud reports through ReportFraud.ftc.gov. Elsewhere, consult the relevant local reporting service and the actual parking operator. This guide does not promise reimbursement or determine whether a particular phone was compromised. For related account protection, our passkey guide explains domain-bound sign-in; our Incognito guide explains why private browsing is a separate issue from identifying a genuine website. Both are linked in the related technology stories below.