QR codes on parking meters, packages and texts

Where fake codes turn up

• Parking meters. The FTC has warned twice, in December 2023 and in September 2026, of reports that scammers cover the real codes on parking meters with their own. The FTC says a code like that can "take you to a fake site designed to steal your money, your personal information, or both."
• Emails and texts. The FTC's December 2023 alert describes codes sent with a made-up reason to scan: a failed delivery, a problem with your account, or "suspicious activity" that requires a password change.
• Unexpected packages. The FTC has described unexpected packages with a note asking you to scan a code to find out who sent it, and the FBI has described packages, often sent without sender information, whose QR code asks for personal and financial details or installs harmful software. The FBI notes this one isn't as widespread as other schemes, and its advice is: "Do not scan QR codes from unknown origins." The FTC adds that you're allowed to keep merchandise you didn't order.
• Traffic-ticket texts. In April 2026 the FTC described texts made to look like court notices, with a QR code and two choices: go to a hearing, or "pay the fine now." See texts about an unpaid toll.
• Crypto payments. The FTC says scammers who direct people to cryptocurrency ATMs may have them scan a QR code the scammer gives them, which sends the money straight into the scammer's wallet. See investment and crypto scams.

How to scan carefully

The FTC's advice in its December 2023 alert comes down to looking before you tap:

"If you see a QR code in an unexpected place, inspect the URL before you open it."

"If it looks like a URL you recognize, make sure it’s not spoofed — look for misspellings or a switched letter."

Federal Trade Commission, December 6, 2023

1. Point your camera at the code, but don't tap yet. Your phone may show the web address first. The FTC notes that "Many QR readers preview the link they will send you to."
2. Read the registered domain. Skip the https:// at the start and find where the website name ends (at the first /, ? or #). If you see an @ or a backslash before that point, stop: both can hide the real name. Then read the last two parts of the name, on either side of the last dot (three for endings like .co.uk). Is it the city, the company or the agency you expect? A city's or company's name earlier in the address proves nothing, and a payment page or form on a big company's address, such as a Cash App or PayPal payment page, can still be a stranger's. If you'd like a second look, many phones let you press and hold the address to copy it, and you can paste it into our link checker.
3. A preview that looks right isn't proof. If it shows a link-shortening service, the real destination is hidden, so don't open it. When in doubt, pay at the meter, or type in the city's address yourself.
4. For parking, look at the code itself. A sticker on top of the meter's printed code is a reason to pay another way, such as at the meter, by the city's own app, or by typing in the city's address.
5. Don't scan codes in messages you weren't expecting. The FTC's December 2023 alert: "Don’t scan a QR code in an email or text message you weren’t expecting — especially if it urges you to act immediately."

Keep your phone ready

The FTC also suggests keeping your phone's operating system and apps updated, and protecting your accounts with strong passwords and two-step sign-in (often called multi-factor authentication). Those steps help, but not with everything. In the FBI's words, "MFA will not protect you if you land on a fraudulent login page." (MFA is the same two-step sign-in.)

If you scanned a code and typed something in

From the FTC's September 2026 alert:

• Don't contact the people behind the site; they may try to get more money or information.
• Change your passwords right away, especially any you reuse elsewhere.
• Check your card and bank statements for charges you didn't make.
• Report it at ReportFraud.ftc.gov.

If you paid on the site or typed in a card number, call the number on the back of that card today, tell them it was a scam, and ask them to cancel the card and refund your money: the FTC's advice for a card payment is to report it to the card issuer immediately. If you typed your bank's password or a code, call your bank first. If you see other charges you didn't make, call your bank at the number on the back of your card too. If you entered personal details such as your Social Security number, the FTC's January 2025 alert suggests checking your free credit reports at AnnualCreditReport.com and considering a credit freeze. Our "if you clicked" page explains how.

A code can also install harmful software: the FTC says one could download malware onto your phone. If scanning a code downloaded an app or asked for permissions on your phone, see what to do if someone got into your computer or phone, and mention it when you report: the FBI asks for "Any applications you may have downloaded or provided permissions to on your electronic device."

Related patterns

• Texts about a package or a delivery problemA missed delivery, a bad address or postage due, and a link.
• Texts about an unpaid tollA small toll balance, a late fee and a link to pay.
• Investment offers, crypto and “guaranteed” returnsA friendly expert, a platform that shows big gains, and no way out.