That QR Code on the Parking Meter Might Not Be the City's

Here's the whole post in one sentence: before you scan a QR code stuck to something out in public, run your thumbnail across the edge of it. If it peels, it's a sticker somebody put there — and it isn't going where the sign says. That's it. That's the trick, and it costs you two seconds.

I'll be honest — when I first read this one I thought "well, that's a big-city problem." Then I thought about how many QR codes I scan in a normal week around here without a second's hesitation. The table tent at lunch. The bulletin at church. The flyer stapled to a pole on Ashley Street. The little card in a box off the porch. I scan them the way you'd take a menu from a waitress. That reflex is exactly what this scam is built to use.

What did the FTC actually warn about?

On September 3, 2026, the Federal Trade Commission published a consumer alert titled "See a QR code parked somewhere? Don't scan it…yet!" It says people have reported scammers covering up legitimate QR codes on parking meters with a QR code of their own — one that takes you to a fake site designed to steal your money, your personal information, or both. You think you're paying four dollars for parking. You're actually handing your card number to somebody who printed a sticker.

This isn't a brand-new idea, which is the part that should get your attention — it's a working one that keeps coming back. The FBI's Internet Crime Complaint Center put out a public service announcement about malicious QR codes back on January 18, 2022 (PSA number I-011822-PSA), and its very first piece of advice is the one I opened with: "ensure the code has not been tampered with, such as with a sticker placed on top of the original code." Four and a half years later the FTC is warning about the exact same sticker. That tells you it still works.

The FTC has flagged two other flavors of the same trick recently, and both have shown up in this area:

If that last one sounds familiar, it's the same playbook as the fake toll and fake package texts — I wrote up that whole family of scams in how to not fall for fake text and phone call scams. QR codes are just the newest wrapper on a very old package.

Is it safe to scan a QR code at all?

Usually, yes. A QR code is nothing but a web address written in a pattern your camera can read — it's a link in picture form. The square itself can't install anything or "hack" your phone. What can hurt you is the website it opens, and only if you then hand that website something valuable. So the honest rule isn't "stop scanning QR codes." It's: treat a QR code exactly like a link in a text from a number you don't know.

That distinction matters, because I don't want you paralyzed in the drive-thru. Most QR codes you meet are perfectly fine. The risk isn't spread evenly across all of them, and it's worth knowing where it actually sits:

Where you'd actually run into this around Valdosta

Let me be straight with you about the local part, because I'd rather be useful than dramatic: I have not personally found a tampered QR code on a meter in Valdosta. I'm not going to tell you our downtown is crawling with them when I haven't seen it. What I can tell you is that we absolutely have the conditions this scam needs.

Valdosta State's metered lots — Langdale, Baytree, Café, and the Student Union lot — run on the ParkMobile app, at a quarter per fifteen minutes, monitored 6:30 a.m. to 5 p.m. Monday through Friday. Signs at those lots carry a QR code for downloading the app. That is precisely the setup the FTC described: an outdoor sign, no attendant, a code, and a driver in a hurry who's already got their card out. Same goes for pay lots at events, and for any kiosk that's been sitting in the weather.

And honestly, meters aren't even where most of us do our scanning. Around here it's the table tent at a restaurant on North Patterson, the giving code in a church bulletin, the QR on a school fundraiser flyer that came home in a backpack, the sign in a shop window. Those are almost always real. But they're also paper sitting somewhere the public can reach — which is all a sticker needs.

How do you tell a tampered QR code from a real one?

You can't read a QR code with your eyes, so forget trying to spot a "fake pattern." You check the physical code and then you check the link before you tap it. Two steps, both fast.

What do I do if I already scanned one?

First — breathe. Scanning a bad code and then closing the page usually does nothing to you. The damage comes from what you typed after. Here's the order I'd work it, which lines up with what the FTC recommends:

Business owners: your own QR codes are a target too

This one's worth a minute if you've got a storefront, a restaurant, a church, or a booth at an event. When somebody slaps a sticker over your QR code, your customer's bad afternoon has your name on it. They didn't get scammed by a stranger — as far as they know, they got scammed by you. That's a reputation problem you didn't cause and can't easily explain away.

Three cheap things that mostly close it:

If you want a second set of eyes on the whole picture — codes, payment pages, staff training, and whether your website is actually working for you — that's a lot of what I do for small businesses around here. There's more on that under cybersecurity services, and a related read in 7 signs your small business website is costing you customers.

The bottom line

QR codes aren't the enemy. They're a convenience that happens to be very easy to forge in the physical world, because a scam only needs a printer and thirty seconds of nobody watching. The whole defense is a thumbnail on the edge of the code and a real look at the link before you tap. And when money's involved, don't scan at all — open the app or type the address yourself.

Tell your folks about this one, especially if they're the type to scan whatever's put in front of them. It's a two-second habit that closes a whole category of scam, and it's a lot easier to teach than most of what I write about.

Common Questions