Scan at Your Own Risk: The QR Code Scam Spreading Across American Streets
The Sticker on the Parking Meter
It takes about four seconds to scan a QR code, which is precisely the problem. In cities across the United States — from Austin to Philadelphia to Seattle — law enforcement and transit authorities have reported finding tampered stickers placed over legitimate QR codes on parking payment kiosks. The fraudulent codes route drivers to convincing lookalike payment pages designed to harvest card numbers, expiration dates, and in some cases driver's license information for the fake 'parking account.'
The scheme, known in security circles as 'quishing,' has expanded well beyond parking. Fake QR codes have been discovered on restaurant menus, electric vehicle charging stations, charity donation flyers, and — in a wave the United States Postal Service specifically warned about in 2023 and again in 2024 — on letters and packages bearing counterfeit USPS branding, directing recipients to a 'delivery issue' page that requests personal and financial details.
Why Your Phone Stopped Protecting You
There was a time when scanning a QR code displayed the destination URL before opening it, giving users a moment to evaluate whether 'parking-spotify-dot-net' looked legitimate. Modern smartphones have quietly removed that friction. On both iOS and Android, the default camera app now scans codes and opens the link almost instantly, often with no visible preview of where the code is actually taking you.
The change was made in the name of convenience, and it worked — but it also removed the single checkpoint that used to stand between a user and a malicious destination. The result is that a QR code is now the only common link type that most Americans tap without ever seeing the address they are visiting.
How the Scam Works
The mechanics are simple enough to explain in a sentence: a QR code is just a compressed URL, and anyone can generate one for free in seconds. An attacker either places a fraudulent sticker over a legitimate code — a tactic known as 'quishing overlay' — or prints a fake code onto a flyer, letter, or table tent that looks official.
The destination page is typically a near-perfect clone of the real thing: a municipal parking interface, a bank login, a delivery notification. Because the victim arrived by scanning a code in a context that seemed trustworthy — a meter they have used before, a letter with a familiar logo — the usual skepticism that guards against email phishing is often disarmed.
What happens next follows the familiar playbook of credential harvesting. The victim enters payment details or login credentials, which go directly to the attacker. In some variants, the page prompts the user to install a 'parking app' or 'delivery app' that is actually mobile malware.
A Five-Second Checklist
You do not need to avoid QR codes entirely. You need to slow down for five seconds before you scan.
Inspect the code itself. Is it a sticker placed on top of something else? Are the edges lifted, misaligned, or a different color than the surface? On parking meters and EV chargers, look for tampering around the code.
Preview the URL. On iOS, a long-press or the use of a third-party scanner app will often show the destination before opening. On Android, Google Lens can decode a code from a photo without navigating to it. Build the habit of checking where a code actually leads.
Be suspicious of urgency. 'Pay now to avoid a fine' and 'Your package is held — act within 24 hours' are pressure tactics borrowed from every other scam genre.
Prefer typing the URL. If you are paying for parking, entering the official website manually — or using an official app — removes the QR code from the equation entirely.
Watch for unusual requests. A parking meter does not need your Social Security number. A postal notification does not need your bank login. Any request for information beyond what the transaction plainly requires is a signal to stop.
An Old Scam in New Packaging
Quishing is not a new invention so much as an old confidence trick wearing new clothes. The reason it works is the same reason all social engineering works: it arrives in a context the victim has learned to trust, and it asks for exactly the information a legitimate transaction would ask for. The difference is that a QR code strips away the last visible clue — the URL — that used to give people a fighting chance.
Restoring that chance takes only a moment of attention. Look at the sticker. Preview the link. Ask what a parking meter actually needs from you. In a threat landscape where the attack surface is now a two-inch square of printed paper, the most effective security tool is still the one between your ears.
