The Second Half Guide
← Scam & fraud protection Protecting yourself

The parking meter QR code might not be the real one

The FTC issued a fresh consumer alert on a simple trick: a sticker with a fake QR code, placed directly over the real one, at a meter you have no reason to distrust.

By Edward Silva · 5 minute read · Verified against a September 2026 FTC consumer alert

On September 3, 2026, the Federal Trade Commission published a consumer alert about a scam that needs nothing more sophisticated than a sticker and a printer. Scammers place a QR code of their own directly over the legitimate one on a parking meter, a lot payment sign, or a toll notice — and wait for someone to scan it.

It works because nothing about the meter itself looks wrong. The post is real, the sign is real, the parking spot is real. The only thing that’s been touched is a two-inch square of paper, often printed to match the size, shape and color of the legitimate code closely enough that it registers as normal on a quick glance.

Most fraud aimed at this age group runs on urgency — a caller who needs an answer in the next five minutes, before there’s time to think it through. This one is different. There’s no caller, no deadline, no one on the phone at all. It just waits at a meter for whoever happens to need to park, which is precisely what makes it easy to walk past without a second thought, and why it doesn’t announce itself the way a threatening phone call does.

What the FTC is warning about
September 3, 2026Date of the FTC’s consumer alert on this specific pattern.
Where it shows upParking meters and lot payment signs most often; the FTC and other agencies have also flagged the same trick on toll notices.
How it worksA sticker bearing a scammer’s own QR code is placed over the legitimate one, redirecting your payment and your card details to them instead of the parking operator.
What you can losePer the FTC: your card number, your personal information, or both — not just the price of parking.
The tellA sticker sitting slightly proud of the sign underneath it, or a link that previews somewhere that doesn’t match the parking operator’s name.
Where to report itReportFraud.ftc.gov, and the parking operator or property manager if the meter belongs to a lot or garage rather than the city.

Why a QR code is an easier con than a fake website

A phishing email or a spoofed website at least gives you a full address to look at before you commit to anything. A QR code hides its destination until after you’ve already scanned it — most phones show a link preview, but plenty of people tap through without reading it, especially when they’re standing in a parking lot trying not to be late for something.

Nothing about the meter has to be fake for this to work. Only the two-inch sticker on top of it does.

Also on The Second Half Guide Long-term care: the numbers, before the sales pitch What long-term care actually costs in 2026, who pays for it, and what insurance does and does not do. One of the largest risks in retirement. Read it →

Where this is showing up

Parking meters and lot payment kiosks are the pattern the FTC named specifically. QR-based payment has become familiar enough at meters like these that most people no longer think twice about scanning one — and that familiarity is exactly what makes a tampered sticker easy to miss. It looks like every other QR code you’ve paid with this year.

It is also not an isolated trick. Two related versions have drawn their own federal warnings in the past year. The FBI’s Internet Crime Complaint Center warned in mid-2025 about unsolicited packages arriving with a QR code inside, urging the recipient to scan it to identify a mystery delivery — scanning instead leads to a data-harvesting site or a malicious download. And the FTC separately warned in April 2026 about text messages impersonating a state court or toll agency, claiming a traffic or toll violation and including a QR code to “pay the fine” immediately. All three — the parking sticker, the mystery package, and the toll text — share the same mechanic: a QR code hides its destination, and something ordinary-looking lends it borrowed credibility.

The alternative that sidesteps the whole problem

A tampered sticker only works if you use it. Most parking meters and lots that offer QR payment also print the operator’s official app name or a phone number directly on the same sign. Neither is immune to tampering in theory, but a scammer would need to cover far more of the sign to fake both, rather than the one small sticker over the QR code — using an independently verified official app or phone number, or looking the operator up yourself rather than trusting anything printed on the sign, avoids relying on the QR code specifically. Where the meter itself takes a card or coins directly, that route avoids the QR code entirely. None of this requires distrusting parking technology generally; it just means the QR code on the sign is one option among several, not the only way to pay, and it’s worth defaulting to one of the others whenever they’re available.

What actually protects you

  • Before scanning, look at the sticker itself. A code that sits slightly raised, crooked, or on a different material than the sign around it is the clearest sign of tampering.
  • Most phone cameras show a link preview before opening it. Read the actual web address — check for misspellings or a domain that doesn’t match the parking operator — before tapping through.
  • If a lot has an official app or a phone number printed on the sign, use that instead of the QR code. It is not vulnerable to a sticker.
  • If you already scanned and paid through a code that turned out to be fake, contact your card issuer immediately to dispute the charge and watch for further ones.
  • Report it at ReportFraud.ftc.gov — and if the meter or lot has an operator or property manager, tell them too, since the sticker is still there for the next person until someone removes it.

This one doesn’t require falling for a story or a caller pretending to be someone else. It only requires trusting a piece of paper that had no business being there — which is exactly why a five-second look at the sticker, before the tap, is the entire defense. And it’s a defense that costs nothing and takes no longer than scanning the code would have in the first place: glance at the sticker, glance at the link preview, and only then tap through.

This is general fraud-prevention information, not a substitute for reporting an active scam. The official reporting and assistance resources linked above are the right next step if you or someone you know may be a target.

Where these facts come from

Checked on 4 September 2026 against the sources listed below. Dollar limits and program rules change — if you're reading this well after that date, verify the numbers at the links below.

Edward Silva

Edward Silva

Edward spent more than forty years as a computer professional — long enough to pick up one useful occupational habit: when somebody hands you a summary, go and read the actual documentation. He started The Second Half Guide after noticing that most writing aimed at people his age was either talking down to him or quietly selling him something, and that the plain facts — the dates, the thresholds, the dollar figures — were somehow the hardest part to find.

He's married, with two grown sons, both married themselves. He is not a financial adviser, an attorney or an insurance agent, and this site doesn't tell you what to do with your money. It tells you what the rules actually say, and links to where he checked.

Next up

The five-minute rule

The urgency tell behind most phone and text scams — a different mechanism than this one, worth knowing alongside it.

Read it →
Also on The Second Half Guide The property tax break you might already qualify for Most states reduce, freeze or defer property taxes at a certain age. Almost none apply it automatically, and the age is lower than people assume. Read it →