Social Occasional Last seen May 19, 2026

The QR code in the parking meter or restaurant menu.

A sticker over a real QR code (on a parking meter, a menu, a flyer) sends you to a fake payment or login page.

How it shows up

  • Parking meter sticker Sends to fake pay-by-phone page that captures card info.
  • EV charging station Same idea, higher-dollar transactions.
  • Restaurant menu sticker Captures card during checkout for a meal that was supposed to be paid at the table.
  • Mailed letter with QR Physical letter claiming a refund, package issue, or jury notice, with a QR to verify.
  • Fake utility shutoff notice on door QR to pay immediately.

This one is sometimes called quishing. Someone slaps a printed sticker over the real QR code on a parking meter, an EV charger, a restaurant menu, a poster, or a delivery slip. The fake code goes to a website that looks legitimate and asks you to pay, sign in, or download an app. The address you’re going to is hidden inside the squiggly square. You can’t read it with your eyes.

The reason this works isn’t sophistication. It’s context. QR codes feel official now. You scan a code in a restaurant and expect a menu. You scan one on a meter and expect to pay. Nobody scrutinizes a parking meter sticker.

The newer twist is QR codes mailed in fake package-undeliverable letters. Treat any QR code from an unverified source as untrusted.

Principles to remember

  1. A login screen is only as safe as the page hosting it

    Real-looking login pages are easy to clone. Check the address bar, or skip the link entirely and go to the site directly.

  2. Call back through a number you found yourself

    If someone contacts you claiming to be your bank, the IRS, or a tech company, hang up and reach them through a number you look up independently.

  3. Reach websites by typing the address, not by tapping a link

    Type the address yourself or use a saved bookmark. Tapping a link from an email or text hands the destination to whoever sent it.