Quishing Alert: Malicious QR Code Scams in Public Parking & Restaurants

You park downtown, walk to the meter, and find a neat sticker directing you to scan and pay. The design is unremarkable — a QR code, a short instruction, maybe a city-looking logo. You scan it, a payment page loads, you enter your card, and you get on with your day. Two weeks later there is a parking citation on your windshield and a series of charges on your statement from a merchant you have never heard of.

This is quishing: QR code phishing. The mechanics are old — a fraudulent link, a cloned payment page, harvested card details — but the delivery method removes the single most useful defense consumers have. Everyone has been taught to hover over a link and inspect the domain before clicking. A QR code is a machine-readable image, opaque to human inspection. You cannot hover over a sticker. By design, you are asked to trust a destination you cannot see.

The other reason quishing works is that it moves the attack into physical space, where our threat model is weaker. Most people apply real skepticism to an unexpected email and almost none to a printed sign in the environment. A sticker on a municipal parking meter reads as infrastructure, not as content someone uploaded. That gap — between how much we scrutinize digital messages versus physical signage — is exactly what the scam monetizes.

Where malicious QR codes actually appear

Quishing shows up in both physical and digital form. The physical placements are more common and more effective; the digital ones are increasingly used to slip past corporate email filters, which historically scanned link text but not images.

What happens after you scan

Scanning a code is not, by itself, the moment of compromise. Modern phones do not silently execute anything from a QR code — the scan resolves to a URL and your camera app offers to open it. Everything harmful happens after you tap, which is genuinely good news, because it means there is a decision point between the scan and the loss.

From there, the attack follows one of three paths. The most common is a cloned payment page: a convincing replica of a municipal parking portal or restaurant checkout that captures your card number, expiry, CVV and billing ZIP — everything needed for card-not-present fraud. The second is credential phishing: a fake login for a bank, workplace or delivery service, often relaying your one-time passcode in real time to log in as you. The third, less common on modern phones, prompts you to install an app or configuration profile from outside the official app store, which is the point at which a scan turns into persistent device compromise.

1. The code resolves to a URL, frequently through a link shortener or a lookalike domain designed to survive a quick glance.
2. Your camera displays a preview banner with the destination. This is the last honest information you will receive, and the step most people skip.
3. Tapping opens a page styled to match the expected brand, often with a genuine logo pulled from the real site.
4. You enter payment or login details. The page may then show a plausible error and redirect you to the real site, so nothing feels wrong.
5. Card data is used or resold within hours; credentials are used immediately while any captured passcode is still valid.

How to check a QR code before you trust it

Two checks handle nearly every case: one physical, performed before you scan, and one digital, performed in the preview banner before you tap. Neither takes more than a few seconds.

The physical check

The digital check

When your camera shows the preview banner, read the domain from right to left. The meaningful part of a URL is the registered domain immediately before the first single slash — everything to the left of it can be set to anything the attacker wants. "cityofdenver.parking-pay.co" is not a Denver government site; the actual domain is "parking-pay.co". This is the most commonly exploited misconception in all of phishing, and it takes about ten seconds to learn permanently.

• Read the registered domain, not the subdomain. Anything before it is attacker-controlled decoration.
• Treat any link shortener on a payment code as disqualifying. A legitimate municipal payment page does not need to hide its own address.
• Watch for character substitution and near-misses: rn for m, a hyphen inserted into a familiar name, an extra word appended to a known brand.
• Check the top-level domain. US municipal services generally use .gov domains; a city parking portal on .co, .info, .app or .xyz deserves real suspicion.
• Look for a mismatch between the brand on the sticker and the domain in the preview. They should obviously correspond.
• If the preview is truncated or you cannot read it clearly, do not tap. Type the address yourself or use the official app.

Paying for parking without scanning anything

Parking is the highest-volume quishing target because the payment is expected, small enough not to prompt scrutiny, and made by someone in a hurry. It also has the cleanest defense of any scenario in this guide: there is essentially never a reason to scan a QR code to pay for parking.

1. Install the official parking app before you travel, from the App Store or Google Play, and verify the developer name matches the city or a well-known operator.
2. Pay at the physical meter with a card or coins where that option exists. Machine payment cannot be redirected by a sticker.
3. If the signage lists a phone number for pay-by-phone, dial it yourself rather than scanning.
4. If you must use a website, type the city’s parking URL from the printed signage into your browser rather than scanning the code beside it.
5. Use a credit card, never a debit card, for any parking or unattended-terminal payment. If it is compromised, you are disputing the issuer’s money rather than waiting on the return of your own.
6. Consider a virtual card number if your issuer offers them. A single-merchant virtual card renders harvested details worthless elsewhere.

If you already entered your details

The habit worth taking away is small and generalizes well beyond parking meters. A QR code is not a destination; it is a request to visit one, and the preview banner is the only place you will ever see where it actually goes. Reading that banner before tapping costs about two seconds and converts an unreadable image back into an ordinary link you can evaluate with judgment you already have. Everything else in this guide is refinement on that one pause.

Editorial note: This guide is general consumer education, not legal or financial advice. Dispute deadlines, liability limits and reimbursement policies vary by institution and change over time. Confirm your specific rights with your bank or a qualified professional. See our editorial policy for how we research and review this content.