QR codes on parking meters, mail, and flyers

A QR code looks the same whoever printed it. Scanning one to read a menu is fine. Paying or signing in on the page it opens is where people lose money.

If it’s happening now

You’re at a meter or pay station with a QR code on it. Use the app or website printed on the meter’s sign, or pay at the machine. If you want to scan, run a fingernail around the code first. A sticker stuck over another code, or over the sign’s printing, is the thing to look for. Skip it and tell the city’s parking office.

A parking ticket on your windshield has a QR code. Don’t scan it or use the site printed on it. Find your city’s parking ticket site yourself and enter the citation number. If it isn’t there, ask the parking office. If they didn’t write it, report it to them.

A code opened a page that wants your card, a password, or your details. Close it. Go in through the app or site printed on the sign, or the one you already use. The FBI says to pay on a site you type yourself, not one a code sent you to.

A package you didn’t order came with a code to “find out who sent it.” Don’t scan it. Keep the item or throw it out. The FTC says the law lets you keep it as a gift. If it came from Amazon or another marketplace, report it there. Change your passwords on shopping sites.

An email, text, or letter wants you to scan a code to fix your account, see a document, or get a refund. Open the company’s app, or type its address yourself, and look there. A real IRS letter can carry a code too. Typing irs.gov and signing in to your account there works either way.

Someone on the phone sent you a QR code to scan at a Bitcoin ATM. Hang up. The code is their wallet, and the cash you put in goes straight to them. No real bank, agency, or company tells you to use a Bitcoin ATM. Already paid: I paid with crypto or a Bitcoin ATM.

You scanned something, looked, and closed it. If you didn’t type anything or install anything, you’re done.

What to say

• I typed my card number into a fake payment page that a QR code opened. Can you close this card, send me a new one with a new number, and dispute the charge? I need a case number.

• The page also asked for a code you texted me, and I typed it in. Can you check which phones and watches my card's on and take off any that aren't mine?

• There's a QR code sticker on the meter at [street and number], stuck over the printed sign. It opens a payment page that isn't yours. Can someone take it off?

If something already left your hands

If you typed a card number or a code your bank texted, call the number on the back of your card first and ask for a case number.

Your card number. Ask the bank to close the card, send one with a new number, and dispute the charge, even if it was a few dollars. The page has the number, the expiration date, and the three digits on the back. If the page said your card didn’t go through and you tried another, replace both.

On a credit card, you aren’t responsible for charges you didn’t authorize. Send the dispute in writing within 60 days of the statement that shows the charge. On a debit card, you’re covered if you report within 60 days of the statement, but the money is out of your checking account until the bank puts it back, so call today. If it was a meter, the city never got paid, so pay again through the app on the sign. More: I paid with a credit or debit card.

A code your bank texted you. Tell the bank on the same call. A fake payment page that asks for that code is often adding your card to Apple Pay or Google Wallet on a phone they hold. Ask the bank to take your card off any phone or watch you didn’t add.

A password. From a device you trust, change it in the real app or on the site you type in yourself, and anywhere else you used it. If the account offers to sign out every other device, do that too. Then set up a passkey or an authenticator app for it. A code by text message is better than nothing. Lock down your accounts in 30 minutes.

Your name, phone number, address, or birthday. Nothing to cancel. Expect calls and texts that use them to sound official. Someone knowing your details proves nothing.

Your Social Security number or a photo of your ID. Freeze your credit with Equifax, Experian, and TransUnion. It’s free. Steps: I gave out a code, password, or card number.

An app or a profile the page told you to install. Delete the app. On an iPhone, also open Settings > General > VPN & Device Management and remove anything listed there that you didn’t add and didn’t get from your work or school. If your banking app is on that phone, call the number on your card first, from a different phone if you can. Then, from a device you trust, change your email and banking passwords. If the phone starts doing things on its own, turn it off and keep using the other device.

Photograph the code, and screenshot the page’s address if you still have it. Then report it at ReportFraud.ftc.gov. If you lost money, also file at ic3.gov. Anyone who later offers to get the money back for a fee is running a second scam: Someone offers to get my money back.

What it looks like

A phone case you didn't order arrived with your name on the label and no sender. The card inside said to scan the code to find out who sent it. You scanned it and tapped the link.

giftnote-reveal.top/r/K7Q2M

GiftNote

Someone sent you a gift.

Your sender left you a private message. Confirm it's you to see who it's from.

Full name
Mobile number
Date of birth

See my message

Don't want it? Start a free return.

It isn't asking for a card or a password. What do you do?

• Fill it in. A name, number, and birthday aren't secret
• Tap "Start a free return." You don't want it
• Close the page. Keep the case or throw it out

Show the answers

• Wrong move Fill it in. A name, number, and birthday aren't secret They aren't secret, but collecting them is the page's whole job. With your number and birthday, the next scam call can sound like it comes from someone who knows you.
• Wrong move Tap "Start a free return." You don't want it The return link comes from the same people as the rest of the page. You don't owe anyone a return. The FTC says the law lets you keep things you didn't order as a gift.
• Best move Close the page. Keep the case or throw it out The FTC warns about notes like this one: the code can lead to a page that collects your details or puts harmful software on your phone. You typed nothing and installed nothing, so you're done.

A package you didn't order doesn't need a scan, a reply, or a return. Keep it or toss it.

There's a parking ticket under your wiper. You scanned its code.

citations-paypark.top/pay

Alder Falls Parking Citations

City of Alder Falls
Parking Citation

Citation #: 20931-7
Violation: Expired meter
Fine: $45.00 (rises to $90.00 after 72 hours)

Card number
Expiration
Security code

Pay citation

The page shows the same citation number as the ticket. What do you do?

• Pay here. The citation number matches the ticket
• Look up the citation number on the city's own site
• Throw it away. It's most likely a fake

Show the answers

• Wrong move Pay here. The citation number matches the ticket Whoever printed the ticket made the page. The two numbers match each other, not the city's records.
• Best move Look up the citation number on the city's own site If the city has it, pay there. If it doesn't, ask the parking office whether they wrote it. If they didn't, it's fake, and they want to know.
• Wrong move Throw it away. It's most likely a fake If it's real, the fine goes up. Looking it up on the city's own site is the quick way to tell.

A ticket can be fake, and so can the site printed on it. Look up the citation number on the city's own site.

At 9:10 you paid $4.35 on a page a parking meter's QR code opened. At noon the city says someone stuck fake codes on the meters on that block.

(312) 555-0119

Text Message
Today 9:10 AM

Fernmont Alert: A purchase of $4.35 at PKQ*ZONEPAY 2290 was made on card ending 4471. Not you? Call the number on the back of your card.

It's the only charge so far. What do you do?

• Nothing. It's $4.35, and nothing else has gone through
• Call the number on your card and have the card replaced
• Watch your statements for the next few months

Show the answers

• Wrong move Nothing. It's $4.35, and nothing else has gone through The page has your card number, the expiration date, and the three digits on the back. Whether and when they use them is up to them.
• Best move Call the number on your card and have the card replaced A new number makes the stolen one useless. Ask them to dispute the $4.35 too. The city never got paid, so if you're still parked, pay again through the app on the sign.
• Okay Watch your statements for the next few months The FTC suggests it. But the number is already on a fake page, and on a debit card a charge comes out of your checking account until the bank puts it back. Replacing it takes one call.

A fake parking page that took a few dollars still has your card number. Have the card replaced, and pay for the parking again the real way.

What they’ll ask for

“Scan to pay.” On a sticker on a meter, a pay station, a parking sign, or an EV charger. The FTC says scammers cover real codes with their own. Use the app or site printed on the sign. Toll and parking texts: A text says you owe a toll or parking fine.

“It’s a gift. Scan the code to find out who sent it,” or “to get instructions on how to return it.” You don’t need to know, and you don’t need to send it back.

“Scan the code below with your phone to confirm your information.” In an email, with no link to click. Open the company’s app yourself. The FTC says not to scan a code in an email or text you weren’t expecting.

“Download our app to finish paying.” The FBI says not to install an app from a QR code. Search your phone’s app store for the app named on the sign.

“Your bank will text you a code to verify the payment.” On a page a code opened, a text like that is often your bank checking before your card is added to a phone wallet the scammer holds. Don’t type it in.

What not to waste time on

Reading the address to decide whether a code is real. Your camera shows a link before anything opens, and an obvious misspelling is worth catching. But many codes, real ones included, open a short jumble of letters that tells you nothing, and fake ones are built to look close to the real thing. If you’re paying or signing in, going in through the app or a site you type skips the question.

A QR scanner app. Your phone’s camera already reads codes, and the FBI says downloading a scanner app raises your risk of malware.