Cindy and I drove downtown for her eye appointment last spring. We found a spot right in front of the building, which in our town is like winning the lottery. The parking meter had a sign: "Pay by phone. Scan the QR code."
So I pulled out my phone and scanned the little black-and-white square. A payment page popped up asking for my credit card number. I had my card halfway out of my wallet when Cindy said, "Bob, why is that sticker crooked?"
Well, folks, she was right. The QR code was a sticker slapped over the real one, and a corner was peeling up. Underneath was a different code with the parking company's name printed next to it. That crooked sticker was a scam.
What is a QR code scam?
A QR code is that square of black and white dots you scan with your phone's camera. It's just a shortcut that opens a web link. The problem is that you can't see where the link goes by looking at the dots.
The FTC has warned that scammers hide harmful links in QR codes, including fake codes stuck on parking meters. The fake code sends you to a lookalike payment page that steals your card number.
How do I check a parking QR code before I pay?
In plain words, three checks. First, look at the code itself. Is it a sticker stuck on top of something, with peeling edges or a crooked label? Second, when your phone's camera shows the web address, read it before you tap. Does it look like the parking company's name, or a jumble of odd words and misspellings? Third, if anything looks off, pay another way: use the app or phone number printed on the official sign, or use coins or a card at the meter itself.
Most phone cameras show you the link in a little bubble before you open it. That bubble is your chance to stop.
What are the warning signs of a fake QR code?
Put simply, be suspicious of a sticker stuck over another label, a web address that doesn't match the parking company, a page asking you to download an app you didn't expect, and QR codes that show up out of nowhere in a text, an email, or a package you didn't order.
Is it safe to scan QR codes at restaurants and doctor's offices?
Usually, yes. A QR code printed on a restaurant menu or handed to you by the front desk at your doctor's office is generally fine, because you know where it came from. The same habit still applies, though. Glance at the web address before you tap, and be extra careful if a QR code page asks for a password or card number.
The riskiest QR codes are the ones in public places where anyone could slap on a sticker, like parking meters, gas pumps, and bus stops.
What if I already paid with a fake QR code?
Call the number on the back of your credit or debit card right away, tell them what happened, and ask them to block the card. Watch your statements for strange charges. Then report the fake sticker to the parking company using the number on the official sign, and report the scam at ReportFraud.ftc.gov. Don't try to peel off the sticker yourself.
If you tapped a link and typed a password somewhere, our guide on what to do after clicking a suspicious link has the next steps.
How we pay for parking now
That day, I put coins in the meter the old-fashioned way and called the parking company's number from the official sign. A nice woman thanked me and said they'd send someone out. Now, before I scan any parking QR code, I look at it the way Cindy looks at a cantaloupe at the grocery store. Carefully, and from a couple of angles.
Checking takes thirty seconds, folks. Losing your card number takes a lot longer to fix.
Have you ever spotted a suspicious QR code? Tell us in the comments where you saw it.
