The Sticker on the Parking Meter: QR-Code Fraud Moved Scams Into the Physical World

The QR code earned its place during the years when touching a shared menu felt unwise, and it never left. It is now the default way to open a link in the physical world: pay for parking, view a menu, confirm a delivery, join a network, follow a poster. The convenience rests entirely on trust in a pattern of squares that a human cannot read, and that gap between what the eye sees and what the phone does is exactly what fraud exploits. The physical version is disarmingly low-tech. A fraudster prints a sticker with their own code and places it over the legitimate one on a parking machine, a table tent, a charging point or a public notice. The victim scans it, lands on a convincing copy of a payment page, and enters card details that go straight to the attacker — while the real meter sits unpaid. The digital cousin, sometimes called quishing, puts the code inside an email or a letter so that the malicious destination rides past the link filters that would have caught a normal phishing URL, because to the security system a QR code is just an image. These attacks work for reasons that have nothing to do with the victim being careless. The destination is opaque until it opens; scanning happens on a phone, where the full address is cramped and easy to skim past; and the context — a car park, a restaurant, a piece of official-looking post — supplies urgency and a plausible reason to pay. Reading a QR code well requires deliberately checking the preview URL, confirming the domain is the one you expected, and being suspicious of any code that leads to a page asking for payment or login credentials rather than simply showing information. Businesses that ask customers to scan carry the other half of the responsibility. A code that a customer is trained to trust is a code worth tampering with, so the practical defences are physical and procedural: tamper-evident or engraved codes rather than stickers, staff who check their own signage, payment flows routed through the recognised app or the official website rather than a bare link, and a clear message to customers about how the business will and will not ask to be paid. As with older payment fraud, the fix is that both sides agree in advance on what a legitimate request looks like, so the fake one has something to fail against.