I Scanned a Fake QR Code: What to Do Now (Parking Meter Scams)

Scanned a QR code that turned out to be fake, like a sticker stuck over the real code on a parking meter? Here’s the short answer: close the page and don’t type anything else. If you paid, call your card issuer now. If you typed a password, change it. If you installed something, delete it and scan your phone. Then report the code.

The FTC warned about this trick on September 3, 2026. People have reported scammers covering real QR codes on parking meters with their own. Scanning one can send you to a fake site designed to steal your money, your personal information, or both. Here are the steps for each situation.

What happens when you scan a QR code? Is it safe?

A QR code is a square barcode your phone’s camera can read. The FBI says it can take you to a website, prompt you to download an app, or direct a payment (FBI). Many QR readers show a preview of the link before you open it, the FTC notes.

QR codes are “not malicious in nature,” the FBI says. The risk is where a tampered code sends you. It can lead to a spoofed site that looks real but steals what you enter, and the FTC warns it could also install malware that steals your information. That’s why the steps below depend on what you did after the scan.

What to do if you scanned a fake QR code

What happened	What to do first
The page opened, but you didn’t type anything	Close it, update your phone and apps, and report the code.
You paid for parking on the page	Call your card issuer using the number on the back of your card.
You typed a username and password	Change that password, and the same one anywhere else you use it.
You typed your Social Security number or other personal details	Go to IdentityTheft.gov and consider a credit freeze.
You downloaded an app or a profile	Delete it and stop logging into accounts on that phone.

The scam recovery checklist can turn your answers into a step-by-step list.

If you only opened the page

1. Close the page and don’t go back. Don’t type anything or use any chat or “contact us” option on it. The FTC warns that if you reach out through a fake site, the people behind it may try to get money or sensitive information out of you.
2. Update your phone’s operating system and apps. The FTC says updates help keep scammy links from turning into a hack. Apple and Google explain how: Update your iPhone or iPad and Check & update your Android version.
3. Watch for signs of malware. The FTC’s list includes lots of pop-up ads, a browser that sends you to sites you didn’t pick, and messages you didn’t write. If you see any, follow the app steps below.
4. Report the code so it can be removed (see below).

More on this: what to do after clicking a phishing link.

If you paid for parking on the fake page

The people behind the page now have your card number. The FBI warns that criminals can use stolen financial information to withdraw funds from victim accounts. Move fast:

1. Call your card issuer. Use the number on the back of your card, or log in to your account online or through the issuer’s app, the FTC says. Tell them a scammer tricked you into paying on a fake parking site, and ask them to refund your money. New York City gave victims of its 2025 meter-sticker scam the same advice: notify your bank or credit card company.
2. Ask for a new card. IdentityTheft.gov’s steps for a stolen card number are to cancel the card and request a new one, then update any automatic payments with the new number.
3. Keep checking your statements. Report charges you don’t recognize as soon as you see them (FTC).
4. Still parked? Pay the real way (see “Parking QR code scams: how to pay safely,” below). The money you paid went to the scammer, not the city.

More detail: I gave a scammer my credit card number. Paid some other way? The FTC lists first steps for each payment method.

If you typed a password or personal details

• A username and password. Change that password right away, and anywhere else you use the same one (FTC). Make it strong, and turn on two-factor authentication. Can’t log in? IdentityTheft.gov says to contact the company and ask how to recover or shut down the account.
• Your Social Security number, date of birth or other personal details. If someone already used your information, report it at IdentityTheft.gov to get a personal recovery plan. If not, or you aren’t sure, follow its steps for information that was lost or stolen (FTC).

The FTC also suggests checking your free credit report at AnnualCreditReport.com (you can get one every week) and considering a credit freeze or fraud alert (FTC). A freeze is free and doesn’t affect your credit score.

Step by step: How to freeze your credit, I gave a scammer my Social Security number, and what to do if a scammer has your personal information.

If you downloaded an app or a profile

The FBI says not to download an app from a QR code; use your phone’s app store instead. If a QR code page already got you to install something:

1. Stop logging into accounts on that phone, like shopping or banking, until it’s cleaned up (FTC).
2. Delete what you installed.
   • An app: delete it. On Android, Google Play Protect checks your phone for harmful apps, including ones from outside Google Play, and may prompt you to uninstall them.
   • A profile on an iPhone or iPad: a configuration profile can change settings on your device. Apple says to go to Settings > General > VPN & Device Management, select the profile, tap Delete Profile and restart. If you see no profiles, none are installed (Apple). If the phone belongs to your employer or school, check with its IT administrator first.
3. Update your security software, run a scan, and delete anything it flags (FTC).
4. Change your passwords and turn on two-factor authentication (FTC).
5. Check your bank and card statements for transactions you didn’t make (FTC).

If someone talked you into giving them control of your device, see I let a scammer into my computer.

Can I get my money back?

It depends on how you paid and how fast you report it. The FTC says it’s always worth asking the company you paid with whether there’s a way to get your money back. But the FBI notes that law enforcement cannot guarantee the recovery of lost funds.

If a scammer uses your card number for charges you didn’t make, the FTC explains the federal limits this way:

Card type	If your number was used but you still have the card
Credit card	You aren’t responsible for charges you didn’t authorize.
Debit card	You aren’t responsible for transactions you didn’t authorize if you report within 60 calendar days after your statement is sent to you.

Less certain: the parking payment you made yourself. Whether you get it back is up to your card issuer, so report it right away and ask.

For a credit card, a written dispute should reach the issuer’s billing-inquiries address within 60 days after the first bill with the error was sent to you. The issuer must acknowledge it within 30 days and resolve it within 90 days (FTC). For a debit card, the CFPB says your bank generally has 10 business days to investigate an unauthorized transaction after you report it.

How to report a fake QR code

1. The city’s parking office. Report the sticker and exactly where you saw it. Use a phone number or website you know is real (FTC), like the city’s official site, not details on or near the sticker. New York City (June 2025), Raleigh, North Carolina (December 2025) and Asheville, North Carolina (February 2026) all asked for these reports after unauthorized codes turned up on their meters.
2. The FTC. Report it at ReportFraud.ftc.gov, as the FTC asks. FTC staff use reports to spot patterns and build cases.
3. The FBI, if you lost money. The FBI asks victims of tampered QR codes to report it to their local FBI field office and to IC3.gov (FBI).
4. Local police. Contact your police or sheriff’s office using its non-emergency number or website (CFPB).
5. If you’re 60 or older, or helping someone who is: call the National Elder Fraud Hotline at 833-FRAUD-11 (833-372-8311), Monday through Friday, 10 a.m. to 6 p.m. Eastern. A case manager helps you report the crime (Office for Victims of Crime, IC3).

Not sure where else to report? Try the report-a-scam tool.

How do I know if a QR code is real?

No check is foolproof, but watch for these signs:

• A sticker on top. Make sure a physical code hasn’t been tampered with, such as with a sticker placed on top of the original code, the FBI says.
• A code the city doesn’t use. Parking rules differ by city. Asheville says it doesn’t use QR codes on parking meters. Raleigh says it uses parking QR codes only on violations and garage tickets. Check the city’s official website, not the sticker.
• A link that’s slightly off. Read the link preview before you open it, and look for spelling mistakes or switched letters (FTC). The FBI says a malicious address may look like the real one but with typos or a misplaced letter. Even a familiar-looking link can be spoofed, the FTC warns.

You don’t need a separate QR scanner app, either. The FBI says downloading one increases your risk of malware, and that most phones have a scanner built into the camera app.

Parking QR code scams: how to pay safely

The FBI’s safest advice is to avoid paying through a site you reached from a QR code. Type a known, trusted web address yourself instead. For parking, that usually means:

• paying at the meter or pay station itself;
• using the city’s official parking app, downloaded from your phone’s app store; or
• typing in the city’s official website address to see which payment methods it accepts.

For example, in June 2025 New York City said the only ways to pay for its metered parking were the city’s official parking app or the meter itself.

Watch for the follow-up scam

Scammers buy lists of people who have already lost money, the FTC warns. Be ready for:

• “Recovery” offers. Someone promises to get your money back for a fee. The FTC says government agencies and legitimate organizations never ask for money to help you get a refund.
• Fake fraud-department calls. A caller may know the card number you typed. Hang up and call the number on the back of your card. Anyone who asks for your verification code is a scammer, the FTC says. More: how to check if a call is really from your bank.
• Fake FBI contacts. IC3 says it never contacts people directly by phone, email, social media or apps, and never asks for payment to recover lost funds.

What varies

• Your city. Some cities use real QR codes for parking, and scammers cover up those legit codes, the FTC says. Others don’t use QR codes on meters at all. The city’s official website is the place to check.
• Your card. Credit and debit cards follow different federal rules, and refund decisions and fraud procedures differ by issuer.
• What the page got. A card number can be canceled and replaced. A Social Security number or a reused password takes more follow-up.
• Where the code was. The FTC has warned about QR codes on packages you didn’t order. If that’s how it reached you, see what to do about a package you didn’t order.