QRishing example: the fake parking meter QR code
A sticker with a QR code shows up on a parking meter or at the entrance of a parking lot. It promises a quick payment and no ticket. The code opens a page that asks for full card details and sometimes the code your bank sends.
Avoid a ticket! Pay in 30 seconds (Red flag 1)
- Plate
- 7ABC123
- Time
- 1 hour
- Total
- $3.50
Card number · Expiry date · Security code · ZIP code (Red flag 4)
To confirm, enter the code your bank sends you by text (Red flag 5)
Pay $3.50Five red flags that give the fake QR code away
Rush and a ticket
The threat of a ticket and the “30 seconds” push you to scan without looking. An official system does not need to scare you into paying.
A sticker on top
Edges that do not line up, different printing, an air bubble: the fake code is usually stuck over the original or next to it. If the sign looks tampered with, do not scan.
A domain that is not the official one
Before opening the link, the camera shows the address. If it is not the city’s, the parking operator’s or the app you always use, close it.
Too much data to pay for an hour
Card number, expiry date, security code and ZIP code together, on a page you do not know, is exactly what someone needs to use your card elsewhere.
They ask for your bank’s code
The code your bank sends authorizes a transaction. If a payment page asks for it separately, it may be authorizing a purchase other than the one on screen.
What to do if you see one
- Do not scan QR codes stuck on the street to pay: use the official app or a payment method you already know.
- If you already scanned, read the address before opening it and close it if it is not the official service.
- Tell the parking operator or the city so they remove the sticker.
- If it happens in your company’s parking lot, report it to security: there may be more stickers on site.
If you already entered your card
- Call your bank on its official number and ask them to block the card.
- If you gave a verification code, mention it on that call: a purchase you did not make may have been authorized.
- Check your statements over the next few days and dispute any charge you do not recognize.
- If you used a corporate card, tell finance and security.
The same trap on other channels
In an email
The QR code arrives in an email “to reactivate authentication” or “to view a document”. The email filter does not read it as a link, and whoever scans it opens it on their personal phone.
On a poster at the office
A poster in the kitchen or the elevator offers “this week’s menu”, “guest wifi” or “the benefits survey” behind a QR code. The destination asks you to sign in with your work account.
On an invoice or a package
A QR code “to track the shipment” or “to pay the difference” on a piece of paper delivered to reception. The same check applies: read the address before opening it.
Questions about QRishing
Other scams to recognize
Who on your team would scan a QR code nobody asked for?
QRishing is a native vector in Whalemate simulations: the campaign puts a QR code in front of each person and measures who scans and who ends up entering data. Whoever falls for it gets short training on that red flag, not a generic course.