How to spot a fake QR code on a parking meter or charging point
Look at the code before you scan it: a sticker stuck on top of the machine's printed code, worn corners or a code that sits slightly crooked are reasons to walk away. Spain's Policía Nacional, the US Federal Trade Commission and local councils in the UK have all warned about this trick, known as quishing. The safer route is to pay at the machine itself or in the operator's official app, downloaded from your phone's app store.
See eSIM pricesA sticker over the real code
The trick needs no technology at all. Someone prints a QR code, sticks it over the genuine one on a parking meter or a payment sign, and waits. The FTC describes exactly this: scammers covering legitimate QR codes on parking meters with their own. The fake code opens a website that looks like the real payment page, and whatever you type there, card number or login, goes to the criminals. The FTC adds that some codes install malware instead.
Parking meters are the classic spot, but not the only one. Charging points for electric cars use QR codes to start and pay for a session, and London's Wandsworth Council asks drivers to be wary of QR code fraud at public chargers. Restaurant tables and posters are the other usual places; menus are covered in our guide to QR code menus abroad.
One eSIM for 33 European countries
Several countries on one trip? Same eSIM, same data, no swapping lines at the border.
Black Friday −25 % Ends in 31d 01:39:08Choose your data
For one to two weeks of maps, messaging and the odd video.
Buy up to 180 days before you fly: the plan only starts when the eSIM connects at your destination.
Write the email where we should send the QR code.
We send the QR code and your receipt here. No spam.
QR in your inbox in minutes · If it does not connect, we fix it · Secure payment with Stripe
Will it work on my phone?
On iPhone: Settings → General → About, and scroll to EID. If there is an EID, your phone takes eSIMs. Every iPhone from the XS (2018) onwards does.
On Android: Settings → About phone → Status, and look for EID. If there is an EID, your phone takes eSIMs. Most Galaxy S20, Pixel 3 and later do.
It also has to be carrier-unlocked. If you bought it outright or your contract is over, it almost certainly is.
Not sure about your model? Ask us before you pay and we will tell you — a person answers within 24 hours.
How it works
- 1Choose and payCard, Apple Pay or Google Pay. No account.
- 2Install it at homeThe QR arrives by email. Scan it on wifi in a minute.
- 3Connect when you landTurn on data roaming for the eSIM and you are online.
Why a trip makes it easier to fall for
At home you know which app your town uses for parking. Abroad you do not. The machine is in another language, it may not take your card, the sign next to it tells you to scan a code, and there is a queue behind you. A fake code relies on exactly that mix of hurry and unfamiliarity.
Hire cars add another layer. You are parking in places you have never been, often in tourist areas where the scam pays best, and the first payment page you see is the one you assume is official. An electric hire car brings chargers into it as well, each network with its own way of paying.
None of this means avoiding QR codes. It means treating a code stuck on street furniture as a link from a stranger: something you check before you open, not something you trust because it is on an official-looking machine.
What to look at before you scan
- The sticker itself. Spain's Policía Nacional has shared a video of a fake code stuck over the real one on a parking meter, and advises looking closely for signs of tampering, such as worn corners or a slight tilt.
- The address. The FTC's advice is to inspect the URL before you open it and look for misspellings or a switched letter. Your phone shows it before loading the page.
- The domain. It should belong to the parking operator, the town hall or the charging network, not to a name you have never seen.
- The request. A parking page that asks you to download an app or enter far more than a card number is a warning sign.
If anything looks off, do not scan it. The police's advice in that case is to look for the app yourself in your phone's app store.
Safer ways to pay for parking or a charge
The most reliable option is the machine itself: coins or a card on the meter, or the card reader or screen on the charger if it has one. Nothing goes through a website you cannot check.
The second is the operator's own app, found by searching its name in the App Store or Google Play rather than through the code. The FTC gives the general rule: if you are not sure, contact the company through a phone number or website you know is real. For parking, the name of the operator or the town's service is usually printed on the machine or the signs, and that is what to search for.
Set this up before you need it. If you know you will park in a particular city, download its parking app at home on Wi-Fi. Our guide to using your phone as a GPS in a rental car covers the rest of the driving setup.
Codes that arrive by message
The same scam also comes without a sticker. The FTC warns about QR codes in emails and texts you were not expecting, with an invented reason to scan: a failed delivery, a problem with an account, suspicious activity that requires a password change. Its advice is simple: do not scan a QR code in a message you were not expecting, especially one that pushes you to act immediately.
On a trip these arrive at the worst moment, mixed in with genuine messages from airlines, hotels and hire car companies. The patterns are the same as with scam links, and our guide to scam texts while travelling explains how to check them without touching anything. A code in a message deserves the same treatment as a link: go to the company's app or website yourself.
If you already paid through a fake code
Call your bank straight away through its official app or the number on the back of your card, and ask for the card to be blocked. Do it even if no strange charge has appeared yet. If you typed a password on the page, change it from a device you trust and turn on two-step verification.
Keep evidence: a photo of the sticker and the machine, screenshots of the page and the payment. Spain's cybersecurity institute, INCIBE, recommends contacting the bank, gathering as much evidence as possible and reporting it to the police; its free helpline, 017, can advise you. In England, Wales and Northern Ireland, report it to Report Fraud, the service that replaced Action Fraud, on 0300 123 2040; in Scotland, to Police Scotland on 101. In the US, the FTC takes reports at ReportFraud.ftc.gov.
Tell the car park operator or the town hall as well, so the sticker is removed before the next driver scans it. To make these calls from abroad, keep your usual line switched on alongside any data-only eSIM, such as Snoozim's, that you use for the trip.
What is quishing?
It is phishing with a QR code instead of a link. The code takes you to a fake page that collects card details or passwords, or installs malware.
How can I tell if a parking meter QR code is fake?
Look for a sticker over the original code, worn corners or a code that sits crooked, and check that the address your phone shows belongs to the operator. If in doubt, pay at the machine or in the official app.
Is it safe to pay for an EV charge with a QR code?
Only if you have checked the code and the address. Using the charger's own card reader or screen, or the network's official app, avoids the risk.
Where do I report a fake QR code in the UK?
To Report Fraud, which replaced Action Fraud, on 0300 123 2040 or online. In Scotland, call Police Scotland on 101.
Get your eSIM before you fly: the QR arrives by email in minutes and the plan only starts when you connect at your destination.
See eSIM prices