Why parking meter QR codes can’t always be trusted

Quick Response codes, or QR codes, are everywhere these days.

From television commercials to restaurant menus to peer-to-peer payment systems, these codes have been widely adopted as a simple way to access online services by simply opening the camera on your phone. Lately, this has also included parking meters.

Cities and counties across the nation are working with app developers to create online payment portals for what used to be an old-fashioned coin-operated service.

Unfortunately, scammers have caught on.

Police in several Los Angeles area beach cities have recently issued warnings over a surge in fake QR code stickers found on parking meters.

“The stickers are made to appear as if you could pay for the parking space via an external website,” Manhattan Beach police warned on social media after removing 14 stickers.

What happens, of course, is that drivers are not directed to a legitimate payment service but, instead, to a convincing but fraudulent site that steals your personal information – and money. The U.S. Postal Service calls it “quishing.”

Manhattan Beach doesn’t use QR codes for parking meter payments, but many others do.

In neighboring Redondo Beach, police found fake QR code stickers on approximately 150 parking meters, on top of or near the legitimate payment stickers.

Since mobile payment is the new norm, experts say consumers need to be educated — and skeptical.

“The convenience of being able to point and pay is enticing — and often outweighs good cyber security practices,” says Sharon Polsky, a technology and privacy consultant based in Canada. “As well, the placement of the stickers is often enough to lend a misleading air of legitimacy.”

Polsky argues that it’s impossible to know where any QR points are, so it’s safer to simply search for the payment site or enter the web address directly into your phone’s browser.

However, if you are going to rely on a QR code, she recommends the following advice:

• If the edges of each line and character aren’t sharp and crystal precise, it might be a fake. 
• Run a fingernail across the sticker onto the surface it’s stuck on. There should be no discernible edge or detectable thickness to the sticker. If there is, it might be hiding another sticker that will be slightly smaller, so its edges won’t be visible. 
• Try to lift a corner or edge of the sticker. If it does lift away from the surface of the parking meter, don’t use the QR code. 

Jeff Le, a government affairs consultant and founder of 100 Mile Strategies, argues that municipalities must take a more proactive approach to educating and protecting drivers.

“This could be done with public awareness collateral in key parking garages, public safety/law enforcement partners, the local DMV, and other local government service areas,” Le told KTLA 5 News.