QR code parking scam: how a fake code steals payment data

The short version

QR codes are not inherently malicious tools, but they are a high-risk vector for fraud when tampered with. A cybercriminal can replace a legitimate code with a tampered QR code to redirect a sender's payment for their own use. This is not a glitch in the camera app; it is a deliberate substitution designed to steal login credentials, financial data, or install malware.

This guide breaks down the mechanism of these attacks—specifically the "parking violation" text scams circulating in the US—and outlines the checks that work. It is not legal advice, nor a step-by-step on how to bypass security. It separates confirmed FBI and state attorney general warnings from general cybersecurity hygiene.

How it works

The core of the scam relies on a redirect chain that hides the true destination until it is too late.

1. The Hook: A victim receives a text or sees a physical sticker claiming an outstanding parking or toll violation. The message demands immediate payment to avoid severe legal consequences, such as a court appearance, fines, or driver's license suspension.
2. The Overlay: The message includes a QR code. In physical spaces, a criminal may stick a fraudulent sticker over a legitimate payment code. In digital spaces, the text message contains a link or image that, when scanned, points to a fraudulent site.
3. The Trap: When the victim scans the code, their phone does not go to a secure government portal. Instead, it navigates to a malicious site. This site often mimics a legitimate payment gateway or court portal.
4. The Theft: The site prompts the user to enter login and financial information. Once entered, the cybercriminal gains access to the victim's accounts. In some cases, the code may also embed malware to gain access to the mobile device itself, stealing location data and personal files.

Crucially, these scams often reference North Carolina laws, a case number, a court hearing date, and a non-existent judge and clerk of court. The details look official, but the authority behind them is fake.

What is sourced

The following facts are drawn from official warnings issued by the FBI's Internet Crime Complaint Center (IC3) and the North Carolina Department of Justice (NCDOJ).

• FBI Warning (Jan 2022): The FBI explicitly states that cybercriminals are tampering with both digital and physical QR codes. They note that while QR codes are not malicious in nature, users must practice caution when entering financial information on a site navigated to via a QR code.
• Parking Scam Specifics: The NCDOJ confirms a specific campaign targeting drivers. The fraudulent message claims an enforcement action has been taken. It demands payment immediately or threatens court appearance, fines, or license suspension.
• Verification Failure: The scam message lists a judge and a clerk of court who do not exist. The text references a specific court hearing date and location that are fabricated.
• Official Response: The North Carolina court system has stated that these messages are fraudulent. They advise recipients to disregard the text and not click on links or scan QR codes.

Caveats

Not every QR code is a scam. Businesses legitimately use them for contactless access and payments. However, the risk increases when:

• Urgency is manufactured: The message demands "immediate action" or threatens legal penalties if you do not pay right now.
• The source is unexpected: You receive a text about a parking violation from a number you do not recognize, or you see a sticker on a meter that looks slightly different from others.
• Payment methods are odd: Legitimate courts and parking authorities typically do not demand payment via text message links or QR codes for immediate resolution.

What to do if you receive a suspicious message: If you receive an email or text stating a payment failed and that you can only complete it via a QR code, call the company to verify. Do not trust the number in the message. If you are concerned about a traffic or parking violation, contact the NC DMV or your local clerk of superior court's office directly using a phone number found on an official government website, not one provided in the text.

What's next

The volume of these scams fluctuates, but the mechanism remains consistent. As more consumers rely on mobile payments, the incentive for criminals to overlay fraudulent codes grows.

• Verify before you scan: If a QR code appears on a receipt, a meter, or in a text message, pause. Check the URL preview if your phone offers it.
• Use official channels: For parking or toll disputes, always go to the official government website or call the number on your physical receipt.
• Report it: If you encounter a suspicious QR code or text, report it to the FBI's IC3 or your state attorney general's office.

Going further

• FBI IC3: Cybercriminals Tampering with QR Codes — The original alert detailing how criminals redirect payments and steal data via tampered codes.
• NCDOJ: New Parking Violation Scam Alert — Specific details on the fake court notices and non-existent judges targeting North Carolina drivers.
• Ready.gov: Cybersecurity Tips — General guidance from the US government on protecting yourself from cyberattacks and financial fraud.