Scammers Are Using QR Codes to Plunder Parking Meter Payments

Phishing schemes already litter the internet, and now they’re coming for our parking meters, too. San Antonio police were first to warn locals about the scam, which targets people trying to pay for their parking ticket via QR code. Authorities say people have started plastering their own QR codes onto the machines, which direct people to scammy pay-portals when scanned.

The police department noted in a separate tweet that anyone who suffered a credit card breach after making a parking meter payment—and suspects they might have fallen prey to one of these scams—to file a police report and notify their bank “immediately.”

It’s a pretty clever (albeit pretty scummy) way to skim a few bucks off car owners, and it turns out San Antonio isn’t the only city being hit here. After San Antonio issued its warning in late December, Austin and Houston began inspecting their own meters. Sure enough, a local Fox News affiliate in the Austin area reported last week that similar fake codes were plastered onto 29 of its parking meters. A local Houston news network then reported that it caught five parking meters with the same fraudulent codes.

The Houston report claims that car-owners who scanned the seemingly innocuous QR codes would be taken to a now-defunct site, “passportlab.xyz,” that would direct people to log into a “Quick Pay Parking” system. After that payment goes through, the bad actor running the site could supposedly make off with the cash—and whoever paid up would be none the wiser.

That said, if you’re driving in these cities, you probably shouldn’t be using a QR to pay for your parking in the first place. Houston officials recently issued a press release reminding residents that the city doesn’t use QR codes for payment now, and never has in the past—it’s always accepted coins, bills, or credit cards. Austin officials put out their own release saying the city uses those same three payment methods, and any QR codes seen in the wild “may have been created with malicious intent.”

While this scam seems to be centered in Texas—and hitting Texas parking meters, specifically—QR codes are everywhere. Thanks to the pandemic, businesses across the country have hopped on the touchless transaction train, and will likely be keeping these two-dimensional pieces of tech around for the foreseeable future. This whole debacle should be a reminder for all of us: the next time you’re sitting at a restaurant or bar and scanning the code in front of you, be sure to double-check where that code leads.