Fake QR code stickers in Mississauga are back on parking machines, according to a notice the city issued on 5 November 2026. The City of Mississauga, in Ontario, Canada, says it learned the day before that fraudulent codes had appeared on its pay-and-display machines at various locations, and that staff removed them. It is a small story with a useful lesson for anyone who puts QR codes on public equipment: removing the stickers once does not end the problem. This article covers what was reported, how it compares with the first wave in April, and what a dynamic QR platform can and cannot do about repeat attacks.
Disclosure: we make D-QR, a dynamic QR code platform. A sticker on someone else's machine is outside any software's reach, ours included. We say where our product helps and where it does not.
Fake QR code stickers in Mississauga: what was reported in November
InSauga, a local news site, reported on 5 November 2026 that Mississauga officials were again alerting drivers after more bogus QR code stickers appeared on parking machines. According to that report, the city issued a public safety notice on the Thursday morning, saying it became aware on the Wednesday of fraudulent stickers on pay-and-display machines at various locations. The city said staff were deployed immediately and removed them.
The city's own message is blunt: QR codes have never been a legitimate way to pay at its parking machines, so any code on one is not genuine and should not be scanned. It says the unauthorised codes are designed to redirect people to third-party payment sites that are not connected to the city, which puts personal and financial information at risk. The reports we could read give no count of stickers or victims for this second wave, so we will not offer one.
How the first wave compares
The November notice follows an earlier one. On the city's own news page, Mississauga says it became aware on 22 April 2026 of fraudulent stickers on pay-and-display machines in the downtown area, and that staff removed roughly 80 within an hour of discovery. Crews were then sent to check every machine. At the time, a city official told CBC News it was the first time that behaviour had been noted in Mississauga, and CBC reported that the stickers pointed to a fake parking payment site, with the destination changing over time.
So the pattern is clear. A fast response worked in April, in the sense that the stickers came off quickly. It did not stop someone coming back about six months later. That is typical of low-effort, low-cost crime: a sheet of stickers costs very little, and an unattended machine in a busy area is an easy target.
Why this keeps happening
A QR code is a grid of squares, and looking at it tells you nothing about where it goes. A pasted-on fake looks as official as the real thing. The driver is in a hurry, the machine is unattended, and the payment page that follows can look convincing. We covered the same pattern in our article on a fake sticker in Oban, Scotland and in our wider piece on fake QR code stickers on parking meters.
What software cannot fix
Mississauga does not use QR codes for parking at all, so there is no genuine code of the city's for a platform to manage. Even where an operator does use QR codes, the stickers are not created in anyone's account, and nobody can switch them off from a dashboard. A QR platform cannot stop a person sticking a label on a machine, and it cannot remove it afterwards. That job belongs to people who walk the site.
Be sceptical of any product that claims to make a printed code tamper-proof. The honest position is that the first line of defence is physical: inspect, photograph, remove, and repeat.
What the Mississauga approach gets right
The city's policy has one great advantage: it is simple. Because the city never uses QR codes for parking, any code on a machine is fake by definition. A new member of staff can apply that rule on day one, and so can a driver who has read the notice. There is no judgement call about whether a particular sticker looks legitimate.
The notice also tells people what a fake looks like. It describes a sticker placed on or near the machine rather than built into it, a code that asks you to scan to pay, a payment site with a slightly different address or spelling, and codes with partial logos meant to look official. And it gives drivers one route for reporting: call 311, so staff can remove the sticker quickly.
If you do use QR codes, what a dynamic code can add
If you run a car park, venue or any site where customers legitimately scan a code to pay or get information, a dynamic QR code generator gives you tools to spot trouble sooner and respond without reprinting. These are things we can confirm the product does.
- One code per location. If every machine has its own code, the scan log shows which location has gone quiet. QR code tracking records each scan with its country, city and device. A code that normally logs scans daily and suddenly logs none, while footfall is unchanged, is a reason to go and look. It is a hint rather than proof, because a genuine code that has been covered will also go quiet.
- Cleaner numbers. Bot filtering keeps link previews and crawlers out of the counts, so a quiet code really is quiet.
- Alerts on busy codes (Pro). Scan alerts and webhooks are available on the Pro plan, so an unusual change can reach you or your own systems without anyone refreshing a dashboard.
- Re-point or pause in seconds. If a genuine code is still visible and you learn of a scam, you can point it at a notice such as "beware of stickers, pay at the machine or in our app", and every printed copy updates at once. You can also pause it. Editing a QR code after printing explains how this works.
- Controls per code. Country restriction, a password and an expiry date can be set on individual codes. Codes have no expiry unless you set one, and free-plan codes stay live.
- A recognisable address. On paid plans, a code can run on your own domain, so the preview a phone shows names your organisation. See how to use a custom domain for your QR codes.
None of this will reveal a scammer's sticker. It can only show what your own codes are doing, which is often enough to prompt a site visit. For the mechanics behind it, our pillar guide, What Is a Dynamic QR Code?, explains why a redirect you control is easier to manage than a code with the address baked in.
What operators should do after a first incident
- Assume it will return. Mississauga's two notices are about six months apart. Build a regular inspection into the schedule rather than treating the first sweep as the end.
- Photograph every genuine code in place so an overlay or swap is obvious to the next person on patrol.
- State plainly whether QR payment exists. If it does not, say so on the machine in words.
- Give people one easy way to report. A single phone number or form beats a list of options.
- Keep a record per machine. Note where stickers were found and when, so a pattern shows up.
What drivers should do
Look for a sticker on or near the machine, check that the address your phone previews matches the operator named on it, and pay through the machine's own prompts or the operator's official app. If you already paid through a suspicious code, contact your bank and report it. Our guide, are QR codes safe?, covers the wider picture.
The takeaway
The Mississauga story is thin on figures, and that is part of the lesson: the public does not yet know how long these stickers were up or how many people scanned them. What it does show is that a fast response solves today's problem, not next season's. Plan for the second wave, make genuine codes boringly predictable, and treat inspection as routine. If you want to see how scan logs and pause controls work before deciding what you need, you can make a QR code for free.
Sources
Incident details come from InSauga's report of 5 November 2026, the City of Mississauga's April 2026 notice and CBC News's April 2026 report. Product statements reflect our own plan documentation at the time of writing.