TrustScanQR Code Sticker Scams: How They Work
The scam is physical: a criminal prints a QR code sticker and places it over the genuine one on a parking meter, restaurant table or delivery card. Scanning it opens a convincing payment or login page. The code is not hacked — it has simply been replaced.
Where it happens most
Parking meters and pay-and-display machines, restaurant tables and menus, EV charging points, delivery cards pushed through letterboxes, and posters in stations. The pattern is consistent: places where paying by phone is normal, where you are in a hurry, and where nobody is watching the sign.Why it works so well
Every other kind of phishing gives you something to inspect. An email shows a sender address and a link you can hover over. A QR code shows a pattern of squares that means nothing to a human eye. You are being asked to trust something you cannot read, in a context that has trained you to scan without thinking.How to spot a tampered code
Run a fingernail along the edge — a sticker placed over print has a lip you can catch. Look for a mismatched shade of white, a slightly different size, or a code that sits oddly relative to the surrounding design. On official machinery, be suspicious of any code on a sticker at all: most councils and operators print directly onto the housing.The pretexts to distrust
Parking fines, failed deliveries and account suspensions. All three manufacture urgency, and urgency is the entire mechanism. A genuine parking machine takes payment without needing your card details typed into a web form on your phone.What to do if you already scanned one
Scanning alone does almost certainly nothing. If you entered card details, call your bank now and freeze the card. If you entered a password, change it wherever else you used it. If you installed anything, remove it. Then report the sticker to whoever owns the machine — most have no idea it is there.Check a link before you trust it
Anyone can print a QR code and stick it over yours. TrustScan reads the address and runs 21 checks on it before the page opens — free, offline, and on every scan. Try the checker or get the app.