The sticker is only the starting point
Fictional example: Karim parks outside a museum. A QR sticker on the meter says “Pay here”. One corner is lifting, revealing another marking underneath. Karim enters no card details and checks the other payment information displayed at the car park.
BACS and the FTC describe overlaid parking codes as a fraud pattern. However, an extra sticker could also be a genuine update. Its presence is not automatically proof of fraud. It is a reason to verify the operator and payment route independently.
Compare operator, location and price
Read the operator details, parking zone and tariffs. Do these match the application you intend to use? Before paying, check the vehicle registration, location, duration and total amount. A familiar payment logo alone confirms none of these details.
If the operator supports an app you already know, open it yourself and select the correct zone. Do not rely only on automatic location detection. A correctly purchased ticket for the wrong car park may not demonstrate payment for the place where you actually parked.
Check the destination before entering information
If you scanned a code, look at the actual web address before using the page. Unusual spelling, an unrelated domain or an unexpected sign-in request is a reason to stop. HTTPS or a padlock icon does not by itself establish a legitimate parking service.
If you cannot confidently connect the address to the operator, you need not investigate further. Choose an independently confirmed alternative. Do not install an extra application merely because an unknown QR page insists on it. A parking payment should not require disclosing passwords for unrelated accounts.
Choose an alternative without ignoring parking rules
Use another officially listed payment method where available. If the process is unclear, contact the operator through independently obtained details. If no reliable payment option is available, choose another permitted parking place rather than assuming that parking becomes free.
For a report, record the location and suspicious code without unnecessarily photographing people or vehicle registrations. Do not damage the meter or remove its components. The operator should investigate the concern and confirm the proper payment route.
If you already scanned or paid
Separate the actions: reading the code, opening a page, entering card details, approving payment or installing an app. After only opening a suspicious page, close it and avoid further interaction. This is a different situation from an already authorised transaction.
For disclosed card information, contact the card provider promptly. For an unfamiliar installation, obtain qualified technical help. Keep payment records and location details. Whether money can be recovered or a parking payment recognised must be resolved by the relevant providers; this article cannot guarantee either outcome.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Are all parking QR codes dangerous?
No. Many are legitimate payment routes. Being displayed in a public car park does not alone confirm their origin.
Is my phone hacked because I scanned the code?
That conclusion does not follow from scanning alone. The page opened and any subsequent actions are what matter.
Can I park free if a code looks suspicious?
This guide grants no such permission. Confirm an official payment option or choose another permitted parking place.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- FTC: QR-Codes an Parkautomaten prüfen, September 2026Source review date:
- BACS: Gefälschte QR-Codes für ParkgebührenSource review date:
- FTC: Schädliche Links in QR-CodesSource review date:
