Fake QR Codes on Parking Meters: 5 Tips to Protect Yourself from "Quishing"
Digital payment methods are becoming increasingly popular for parking—and criminals are taking advantage of this. Their target: the convenient QR codes on parking meters that allow drivers to pay quickly and easily. ParkRaum-Management PRM GmbH, based in Erlangen, explains how drivers can protect themselves from “quishing” attacks.
There has been a recent surge in reports in Germany of fake QR codes on parking meters. Scammers cover the genuine QR codes from parking apps or the operator’s payment website with manipulated stickers. When drivers scan these codes, they are redirected to phishing sites that look deceptively real. There, their sensitive data is stolen or payments are diverted to the scammers. This is known as “quishing”—a combination of “QR code” and “phishing.”
“Parking meter tampering is a problem that we, as a digital parking management company, take very seriously,” explains Marko Guljelmovic, managing director of ParkRaum-Management PRM GmbH. “However, drivers can easily protect themselves against it if they know what to look out for.”
PRM therefore offers drivers five practical tips on how to protect themselves from tampered QR codes:
- Keep your eyes open when scanning: The QR code may be affixed as a separate sticker. If a code looks suspicious—for example, because it clearly covers up other text—it’s best for drivers not to scan it.
- Check web addresses: To verify that the URL of the payment website is correct and trustworthy (e.g., https://, which matches the operator’s official domain), drivers should use their smartphone’s preview function when scanning the QR code. Fraudulent websites often use slightly altered addresses.
- Check website content: If the QR code and URL look trustworthy, check the website for suspicious spellings of words (such as “ü” written as “ue”) or odd phrasing.
- Be careful with personal information: If a website asks for unusual information, such as your PIN or bank account password, stop the process immediately.
- Use alternative payment methods: If drivers are unsure, in most cases they can also pay directly through a parking app or with cash or a card.
An important note about parking apps: The standard QR codes displayed on parking meters rarely lead to payment pages. The actual QR code simply directs you to the app (if it’s already downloaded) or to the download page in the Apple App Store or Google Play Store. However, the apps can also be easily downloaded without a QR code, and parking areas can be found manually by entering the zone code. This way, parking apps can still be used safely.
If you come across a suspicious QR code at a parking meter, you should inform other drivers and report the incident to the operator or the police. If the QR code has been scanned and sensitive information, such as bank details, has been entered on a suspicious website, those affected should contact their bank immediately and file a police report.
