QR Code Scams on Parking Meters and Charging Stations: How Fake QR Codes Work and How to Protect Yourself

A scammer doesn’t need to hack a parking meter or a charging station. All they need is a sticker with their own QR code, which they stick over the original. This type of scam is called “quishing,” or phishing using QR codes. Authorities in both the U.S. and Europe have issued warnings about it, and it has also been encountered in Bratislava. However, one should be cautious about claims of a “massive increase,” as figures found online often come from unreliable sources.

How quishing works on parking meters and charging stations

A scammer prints a sticker with their own QR code and sticks it on a parking meter or charging station, most often directly over the original code. When scanned, the phone opens a page that mimics a legitimate payment service. The victim enters their card information, along with their license plate number and parking duration, and the scammers obtain this data.

The QR code itself is not dangerous. It is merely a way of encoding a link, but when scanning it, the user cannot see where the link leads. This is what sets this attack apart from classic email phishing: it exploits a physical location where scanning is commonplace and where a payment is expected.

What’s Been Verified

Bratislava and the Czech Republic

According to a report by JOJ TV on April 30, 2025, fake stickers appeared on nearly a dozen parking meters in Bratislava, primarily in the Old Town. The website they linked to featured the logo of the EasyPark parking app operator. The city states that it has approximately 200 parking meters and, together with the municipal police, inspects them both physically and by scanning QR codes. At the time of this report, the city had not encountered any cases where someone was fined after paying with a fake ticket. According to this report, technical services in Prague have also dealt with similar cases.

Germany and Ireland

The city of Chemnitz stated in a press release that it found stickers with fake QR codes on some parking meters. These led to a website where victims were required to enter not only their card information but also the parking zone, license plate number, and parking duration. The city filed a criminal complaint. In September 2026, Irish police (Gardaí) in Donegal also warned of quishing at parking meters, charging stations, and on posters.

USA

In June 2025, the New York City Department of Transportation issued a warning about a fraudulent sticker on a parking meter. According to sources from October 2026, dozens of fake stickers were later found and removed in Manhattan, and one man was charged in connection with the incident. This is a report from a local media outlet, so it’s worth verifying the details on the official government website before publishing.

Electric Vehicle Chargers

The security company ESET has highlighted reports from the UK, France, and Germany indicating that scammers are placing malicious QR codes over legitimate ones at public charging stations. Some reports also mention signal interference intended to force victims to use the QR code instead of the app. I have not found this claim confirmed by a reliable source, so please consider it unverified.

What the Numbers Say About the Increase

A figure is often cited stating that quishing increased by 146% in the first quarter of 2026. It comes from several blogs, but I have not found the primary source. Other figures citing increases of hundreds of percent, as reported by companies selling QR services, are similarly unreliable. Therefore, I do not cite any specific percentage as fact. What is certain is that authorities in various countries have repeatedly warned about this phenomenon.

Another variant: stickers on cars

According to the Ministry of Investment, Regional Development, and Informatization, the Slovak government’s CSIRT has also warned of a scam involving QR code stickers on cars, which are supposed to alert drivers to an alleged traffic violation and redirect them to fake payment sites. This is another form of physical phishing.

How to Protect Yourself

• Check the sticker. Operators and experts recommend checking whether the QR code is stuck over another one, whether it sticks out, or whether the edges don’t line up.
• Only scan the code displayed directly on the terminal. According to ESET, never scan a code that isn’t on the charging station or parking meter terminal itself.
• Use the official app. Both the parking operator and the city of Chemnitz recommend paying through the app installed in advance, not via a QR code.
• Use other payment methods. Many parking meters accept cards, NFC, or coins.
• Check the website address. Grammatical errors and an unfamiliar domain are red flags. Official government portals use the domains .gov.sk or .slovensko.sk.
• If you’ve already entered your information, block your card, contact your bank, and report it to the police.

What Operators Can Do

A specialized parking website suggests possible solutions such as printing a QR code directly on the ticket or displaying the code on the machine’s screen instead of using a static sticker. Cities are responding with regular inspections, for example in Bratislava and New York.

Conclusion

Quishing is cheap, simple, and exploits trust in QR codes. There is little reliable data on how widespread it is, but cases involving parking meters have been documented in Bratislava, Germany, and the U.S. The best protection is simple: pay through the official app or with a card, and don’t scan a code that’s been stuck over another one.