Quishing: parking-meter QR sticker scams hit major US cities
Scammers are placing fake QR code stickers over real ones on parking meters in San Francisco, Austin, Boston, and other major cities. Victims who scan and pay get nothing — except a drained bank account.
It started in San Francisco in February. Drivers parked legally, scanned the QR code on the meter, paid the displayed amount through a familiar-looking payment page, and walked away. Hours later they came back to a parking ticket — and within days, fraudulent charges on their cards.
The scam is mechanically simple: scammers print weatherproof stickers with a malicious QR code and place them over the real codes on parking meters. The fake QR points to a phishing site that mimics ParkMobile or PayByPhone, captures card details, and never actually pays the meter.
Since February we've logged 21 reports tied to this campaign, with confirmed sightings in San Francisco, Oakland, Austin, Boston, Philadelphia, and Washington DC. Total losses are relatively small per victim ($410 average) but the operation scales fast — a single scammer can sticker 100+ meters in a night.
Restaurants are the next frontier. We've started getting reports of fake QR stickers placed over the real ones on table-tent menus, especially in tourist-heavy areas. The fake codes lead to phishing pages disguised as the restaurant's online menu, then ask for payment details to 'pre-order'.
Defense is straightforward: download the official parking app for any city you visit (ParkMobile, PayByPhone, Park Boston, etc.) and use the app instead of scanning meter QR codes. For restaurants, ask the server for a paper menu if anything about the QR code looks tampered with — peeling edges, a sticker layered over another, or a domain that doesn't match the restaurant brand.