Stop Scanning QR Codes. The Parking Meter Sticker Hiding a Massive Cyber Threat.

You pull into a parking space, grab your bags, and casually scan the QR code on the meter to pay. Or you sit down at a restaurant and scan the table code to pull up the menu. It's a completely mundane action — something 73% of Americans do without a second thought.

But in 2026, that innocent little square could drain your bank account. The FBI warned in a 2022 Public Service Announcement that cybercriminals are tampering with QR codes to redirect victims to malicious sites that steal login and financial information. Since then, the problem has exploded: QR code phishing attacks — known as "quishing" — have increased 400% between 2023 and 2025. Microsoft found that 25% of all email phishing attacks in late 2024 used QR codes as the primary lure.

Scammers love QR codes for one simple reason: human eyes cannot read them.

When a scammer sends you a text link that says chase-bank-secure-alert.info, your brain might spot the fake domain. But a QR code completely hides the destination URL until you've already scanned it — bypassing your natural ability to spot danger.

The scale of this threat is massive. Today, 26% of all malicious links are delivered via QR codes. Over a recent 12-month period, security researchers detected more than 3 million unique malicious QR codes in circulation. Whether you're paying for parking or checking a work email, you're a target.

Quishing attacks come in two highly effective forms — one in the physical world, one in the digital.

The physical sticker overlay. Criminals print high-quality, weather-resistant QR code stickers and physically slap them over legitimate codes on public parking meters, EV charging stations, bike-share kiosks, and restaurant tables. When you scan what you think is the real code, you're redirected to a pixel-perfect fake payment page. Austin police found fraudulent QR stickers on 29 parking meters, directing users to a fake payment domain. The investigation began after San Antonio discovered over 100 tampered pay stations. Houston found similar stickers on its meters shortly after.

The digital QR code in emails and documents. Scammers embed QR codes in phishing emails instead of traditional links because QR codes bypass most email security filters that scan URLs. Cofense reported a 331% year-over-year increase in QR code phishing campaigns. QR code payloads in phishing emails jumped from just 0.8% in 2021 to 12.4% in 2023. In mid-2024, researchers detected half a million phishing emails containing QR codes embedded in PDFs alone. The FBI issued a fresh warning in July 2025 about unsolicited packages containing malicious QR codes — scammers are now mailing physical items with codes that initiate fraud.

March 2026 update: The IRS Dirty Dozen 2026 list — the agency's annual ranking of the most dangerous tax scams — now explicitly calls out QR codes embedded in fake IRS emails as a top threat for this filing season. Phishing emails impersonating the IRS use QR codes to redirect victims to convincing replica portals that harvest Social Security numbers, filing status, and bank routing information. This is official U.S. government validation that quishing has graduated from a niche attack vector to a mainstream, top-tier threat.

And here's what makes 2026 quishing even more dangerous: what's waiting on the other side of that QR code has gotten dramatically better. A phishing-as-a-service platform called Starkiller, detailed by Abnormal Security and Infosecurity Magazine, uses a reverse proxy to load the actual login page of whatever brand it's impersonating — Google, Microsoft, your bank — inside a headless Chrome container. The victim interacts with the real website through an invisible middleman. That means even multi-factor authentication tokens are captured and relayed in real time, giving attackers instant access to your account.

The combination is devastating: a QR code you can't visually inspect, leading to a login page that IS the real page, capturing credentials AND MFA codes. The old defenses — "check the URL" and "use two-factor auth" — are both weakened simultaneously.

You don't need to stop using QR codes entirely — but you need to stop trusting them blindly.

The Finger Test. Before scanning a physical QR code in public — especially on a parking meter or EV charger — run your finger over the edge. If you feel a raised edge, a different paper texture, or see misalignment, it's a malicious sticker placed over the real code. Walk away.

The Preview Pause. Never blindly tap to open a scanned link. When you point your smartphone camera at a QR code, modern operating systems pop up a preview of the URL. Stop and read it. If the domain looks slightly off, unusually long, or confusing, close your camera immediately.

Go direct to the source. Instead of scanning a parking meter code, download the city's official parking app (like ParkMobile) directly from your phone's verified app store and enter the zone number manually. Same principle applies to restaurant menus — ask for a physical one if the QR code looks suspect.

If you already scanned a bad code and entered payment info — call your bank immediately to freeze the card and monitor your statements for unauthorized charges.