Scammers in a few big Texas cities have been putting fake QR codes on parking meters to trick people into paying the fraudsters. Parking enforcement officers recently found stickers with fraudulent QR codes on pay stations in Austin, Houston, and San Antonio.

San Antonio police warned the public of the scam on December 20, saying that “people attempting to pay for parking using those QR codes may have been directed to a fraudulent website and submitted payment to a fraudulent vendor.” Similar scams were then found in Austin and Houston.

The Austin Transportation Department started examining their own meters after being “notified of a QR code scam by the City of San Antonio in late December—when more than 100 pay stations were stickered with fraudulent codes,” Fox 7 Austin reported last week. Austin officials checked the city’s 900 or so parking pay stations and found fraudulent QR codes on 29 of them, according to a KXAN article.

The fake QR codes reportedly directed people to a “Quick Pay Parking” website at the domain passportlab.xyz, which is now offline. It’s not clear how many people—if any—were tricked into paying the fraudsters.

City doesn’t use QR codes—they’re too easy to fake

“We don’t use QR codes at all for this very reason, because they are easy to fake or place on the devices,” Austin parking division manager Jason Redfern told KXAN. “And we heard from industry leaders that this would be a possibility.” Austin accepts payments directly at the meter with coins or credit or with the Park ATX mobile payment app.

Austin city officials said in a press release that they are “continuing to inspect the City’s more than 900 pay stations to ensure there are no additional QR codes in use.” Austin urged people to call 911 if they see someone without a city employee badge tampering with a pay station. “Any person who believes they were a victim of a credit card breach due to recent parking meter payments should file a police report and notify their card issuer immediately,” the city also said.

Houston officials found five meters with fake QR codes and removed the stickers, according to KPRC 2. Like Austin, Houston does not use QR codes on parking meters but does offer a payment app.

While the scam seems to have been centered in Texas, it could be repeated anywhere. If you see a QR code on a parking meter, ignore it and make sure you pay the city directly.

https://arstechnica.com/?p=1825443