Fake QR Codes in Parking Lots: How Owners Stop the Scam

Fake QR codes on parking signs and meters are a live fraud risk, and the owner is the first line of defense. On September 3, 2026, the Federal Trade Commission warned that scammers are covering real parking QR codes with their own. Owners can cut the risk with tamper-resistant signage, one official payment path, routine sticker sweeps and plate-based payment that needs no code at all.

What the FTC warned about

The scam is simple. A thief prints a QR code sticker. The sticker goes over the real code on a meter, pay station or sign. A driver scans it and lands on a fake payment page.

The FTC says that page can steal money, personal information or both. Its alert is titled "See a QR code parked somewhere? Don't scan it yet." Local TV stations ran the warning across the country the week of September 8, 2026, including WSMV in Nashville.

The FTC's advice to drivers has three parts:

• Check the link preview before opening it. Look for misspellings or swapped letters.
• Keep the phone's operating system and apps updated.
• Use strong passwords and multi-factor authentication.

That advice puts the burden on the driver. Owners can do more, because owners control the sign.

How the fake codes show up in real lots

This is not new, and it is not rare. In August 2024, ABC7 reported that Redondo Beach, California, found fake codes on about 150 parking meters. That fake code led to "poybyphone," one letter off from the real PayByPhone name.

In one case in the same report, a driver's card company called about two minutes after he entered his card number. It flagged unauthorized charges.

In November 2024, Fort Lauderdale warned drivers after city workers found fake stickers at 7 locations, including city garages. Workers removed the stickers on one day and found more the next. The city told drivers to pay only through official meters or the app named on official city signs.

The pattern is the same each time:

1. Stickers go on high-traffic pay points.
2. The fake site copies a real vendor's look.
3. The owner learns about it from a complaint, not an inspection.

Why this is the owner's problem

A driver who pays a scammer still has not paid you. That creates three costs.

Lost revenue. The money goes to the thief, not the lot.

Disputed citations. A driver who "paid" and then gets a notice will fight it. Your staff spends time on the dispute.

Brand damage. The driver remembers the lot where it happened. Reviews follow the property, not the scammer.

There is also a trust cost. When drivers learn to fear QR codes, they stop using the fastest payment option you offer. That slows turnover at the pay point and pushes more people to call or complain.

Seven steps owners can take this month

1. Pick one official payment path per site. Use one app, one short URL and one text-to-pay number. Put the same three items on every sign. Fort Lauderdale's guidance shows why: drivers need to know which app is real.

2. Print the official web address in large text under every QR code. A driver can then compare the link preview to the printed address. This turns the FTC's "check the link" advice into a two-second task.

3. Use tamper-evident signage. Print the QR code into the sign face, not on a sticker. Use a laminate or anti-graffiti film. A stuck-on code is then easy to spot.

4. Add a warning line. One sentence works: "Our code is printed into this sign. Do not scan any sticker." This tells drivers what normal looks like.

5. Sweep pay points on a schedule. Check every meter, pay station and sign on each patrol. Photograph them. Remove and log any sticker. Fort Lauderdale found more stickers the day after it removed the first batch, so one sweep is not enough.

6. Set up a fast report channel. Post a phone number for "suspicious code" reports. When a report comes in, pull the sticker within hours, alert your payment vendor and post a notice.

7. Watch the data. A sudden drop in app payments at one location, with steady occupancy, is a warning sign. So is a spike in "I already paid" disputes from one area.

Plate-based payment removes the code

The strongest fix is to make the code optional. With license plate recognition, the plate is the ticket. The driver enters a plate number in the official app, or pays at a station. Cameras or patrol vehicles read plates and match them to payments and permits.

Cities are moving this way. On October 13, 2026, the Santa Monica City Council voted 7-0 to put license plate readers on parking enforcement vehicles, the Santa Monica Daily Press reported. The five-year contract runs up to $700,000. The city's 30 municipal lots hold 6,212 paid spaces. Plate scans not tied to a citation are purged after 30 days, unless held for law enforcement.

A plate-based system still uses a QR code for convenience. But the code is no longer the only way to pay, and enforcement does not depend on a paper receipt. Owners should still publish a clear data retention policy. Our earlier post on LPR privacy and retention rules covers that.

A quick audit checklist

Use this list on your next site walk:

• Is every QR code printed into the sign, not stuck on?
• Does every sign show the same official app, short URL and phone number?
• Does every sign say how to report a suspicious code?
• Is there a written sweep schedule, with photos?
• Does your payment vendor have a contact for takedown requests?
• Do you track payments by location, so a drop stands out?
• Can drivers pay by plate number, not only by scanning?

If you answer "no" to two or more, fix those first.

How Wins Parking handles this work

Wins Parking designs, builds and manages parking from the Vail Valley, where the family-owned team has worked since 2016. We serve owners across the country.

On the design-build side, Wins Design & Build plans sign locations, pay stations and camera mounts as part of the lot layout. Signs go where drivers see them and patrol staff can check them.

On the management side, our parking management services cover revenue, permits, enforcement and LPR cameras. We set up the payment path, write the sign copy, run the patrols and review the payment data. When a fake code turns up, our team removes it, reports it and posts a notice.

You can see examples of our work on the case studies page.

Next step

Call (970) 279-1744 or start at https://winsparking.com/contact. Drivers looking for a space can book at winsparking.com/reserve.