Fake QR code stickers on parking meters are a simple scam: a criminal pastes their own QR code over, or next to, the real one, and drivers who scan it to pay land on a lookalike site that takes their card details instead. The latest warning came this month from Ann Arbor, Michigan, and it is one of many in 2026.
What happened in Ann Arbor
On 1 October 2026, WXYZ in Detroit reported that Ann Arbor police were warning drivers about fake QR code stickers on downtown parking meters. The stickers carried phrases such as "Scan to Park!" and "Park AA", which look like a convenient way to pay. Police said the codes are fraudulent and could send people to sites built to capture personal or financial information.
A city parking employee was filmed removing one of the stickers on East William Street, and the report says staff have been told to inspect meters and collect any suspicious stickers. Police advice was short: do not scan the code, use an official payment method such as an authorised app, website or kiosk, and report suspicious stickers.
Fake QR code stickers on parking meters are a worldwide pattern
The same trick has been reported across several countries this year:
- Kelowna, Canada. The city said 75 parking meters had been tagged with fraudulent codes in February, and RCMP opened an investigation. Whistler had a similar case, and police in Penticton warned about the same scheme the previous August.
- Mississauga, Canada. In April the city said staff removed roughly 80 fraudulent stickers from pay-and-display machines in the City Centre area, and stressed that the city never uses QR codes to collect parking payments.
- Vancouver, Canada. In June the city warned residents and visitors about stickers on meters and pay stations, at a time when the FIFA World Cup had brought a wave of tourists.
- Christchurch, New Zealand. In July the council found stickers on both council-run and privately owned machines, removed them, and increased daily checks.
- Torbay, England. In February the council warned about stickers carrying a QR code, a phone number and links to download an app.
Why this scam works so well
A QR code is a pattern of squares. Looking at it tells you nothing about where it leads, so a genuine code and a pasted-on fake look equally official. A sticker costs almost nothing to print, a meter is unattended, and the person scanning is already in a hurry to pay and walk away.
The fake page usually looks like a payment screen. The victim enters their card details, the criminals collect them, and the driver may get no proof of parking, which is often the first sign something went wrong. This is the physical cousin of what security people call quishing, and we cover the wider picture in are QR codes safe?
What a QR platform can and cannot do about it
Being straight about the limits matters here. The fake code is not made on your account, and nobody can switch it off from a dashboard. No QR platform, ours included, can stop someone gluing a sticker onto a pole. A sticker overlay is a physical problem, and the first line of defence is people walking the meters.
What a platform can do is make your genuine codes easier to trust and easier to watch:
- Put your real codes on an address people recognise. A code on your own domain shows your name in the preview a phone displays before opening it, so a customer has something to check. See how to use a custom domain for your QR codes.
- Print the address next to the code, in words. A short, memorable custom short link that people can type as well as scan gives them a way to pay without trusting any sticker.
- Use one code per location. If every meter, sign or table has its own code, the scan log shows which location has gone quiet. A code that normally logs scans every day and suddenly records none, while footfall is unchanged, is a reason to go and look. It is a hint, not proof. QR code tracking records each scan with its city and device, and bot filtering keeps link previews and crawlers out of the numbers so a quiet code really is quiet. Creating many codes at once is covered by the bulk QR code generator.
- Be ready to point a real code at a notice. Because a dynamic QR code can be re-pointed in seconds without reprinting, a genuine code that is still visible can be sent to a page saying "beware of stickers, here is how to pay".
What drivers should do
- Look for tampering. A sticker over existing signage, a code that is larger than the official one, or a code stuck next to the official one are all warning signs.
- Read the address before you open it. Your phone previews the link. If it does not match the operator named on the meter, close it.
- Use an official channel. The meter's screen, the operator's own app or a kiosk. In Mississauga, for example, the city says QR codes are never used for parking payments.
- If you already paid through a sticker, call your bank or card issuer at once and report the sticker to the police.
What councils and venue owners should do
- Inspect machines on a schedule, as Christchurch now does daily, and remove stickers on sight.
- Say on the machine itself whether QR payment exists at all. Mississauga and Christchurch both told residents their councils never ask for payment by QR code.
- Photograph every genuine code in place, so a swapped or covered one is obvious to the next person on patrol.
- Treat the same trick as a risk for restaurant tables, car parks and shop counters. We wrote about a different way a table code can be abused in the streamer whose chat ordered ¥1.6 million of food.
For the basics of how a code can be made more resilient, start with our guide to what a dynamic QR code is.