The $2 Parking Scan That Turns Into a $39.99-a-Month Bill: The FTC’s New Warning on Meter Stickers, and the One Tell That Gives Them Away

Scammers are gluing their own QR codes over the real ones on parking meters. You “pay,” the meter never hears about it, and a streaming subscription you never wanted shows up weeks later. Here’s how to spot it in two seconds.

One driver scanned a “Pay for Parking Here” code in a church lot, typed in a card number expecting a few dollars, and got charged $39.99 for a “digital membership service” instead. Another expected a couple of bucks and got a text from the card company about a $49.99 charge before they’d left the lot; the company tried again a few days later (both reports to BBB Scam Tracker, July 26, 2024). On September 3, 2026, the Federal Trade Commission issued a fresh consumer alert on exactly this: people are “reporting scammers covering up legit QR codes on parking meters with a QR code of their own” (FTC, Sept. 3, 2026).

What’s happening

The mechanics are low-tech. A crook prints a sticker with a QR code, walks a block of meters or a pay-and-display kiosk, and slaps it on or next to the real code. Your phone reads the sticker, opens a page that looks like the city’s parking vendor, and asks for a card number. The money, your card number, or both go to the crook (FTC, Sept. 3, 2026). The meter, which only recognizes its own keypad or the city’s official app, never hears about it (NYC DOT, June 6, 2025).

This isn’t one bad block in one city. New York City’s Department of Transportation issued its own advisory after a fraudulent sticker turned up on a ParkNYC meter, launched a citywide inspection of every meter, and reminded drivers that the only ways to pay are the official ParkNYC app or the meter itself (NYC DOT, June 6, 2025). The Better Business Bureau has been logging reports of the same scheme at parking lots and kiosks since 2024 (BBB, July 26, 2024).

What this means for your wallet

The loss isn’t the two dollars. It’s three things stacked on top of it.

The subscription. The BBB’s reports show the fake page often enrolls you in a recurring charge, $39.99 or $49.99 a month, from a company you’ve never heard of (BBB, July 26, 2024). If it slides past you on a busy statement for six months, that’s $240 to $300 gone before you notice, for a parking spot you thought cost two dollars.

The ticket. Because the real meter was never paid, you’re parked without a valid payment and can come back to a citation on top of the theft. You paid twice and parked once.

The card number. Once your card is on a crook’s server, the parking lot is just the first stop. This is where the type of card decides how bad it gets. Under federal law, unauthorized charges on a credit card are capped at $50, and if only the number was stolen (not the card itself) you owe nothing. With a debit card, the cap depends on how fast you report: $50 within two business days, up to $500 if you take longer, and after 60 days from your statement, potentially every dollar in the account, plus linked accounts (FTC, “Lost or Stolen Credit, ATM, and Debit Cards,” Fair Credit Billing Act and Electronic Fund Transfer Act). A debit card at a parking meter puts your checking account on the sidewalk.

The one tell

A sticker. Real payment codes are printed into the meter’s faceplate or its official signage; they aren’t peeling at the corner, layered over something else, or slapped on the side of the pole (NYC DOT, June 6, 2025; BBB, July 26, 2024). If you can get a fingernail under it, don’t scan it.

Two more from the FTC (Sept. 3, 2026): many phone cameras show a preview of the web address before you tap through, so read it, and a single swapped or missing letter means it’s fake. And keep your phone’s operating system updated, because a bad link can do more than steal a card number on an old one.

What to do instead

• Pay at the meter with the keypad, or use the city’s official parking app you downloaded from the app store yourself, not from a code on a pole (NYC DOT, June 6, 2025; BBB, July 26, 2024).
• Use a credit card, not debit, for any payment at a kiosk or on a street. The $50 federal cap is the whole reason (FTC).
• If you already scanned one: don’t contact anyone through the fake site, change any password you typed there, and read your next two statements line by line (FTC, Sept. 3, 2026). Call the card issuer about any charge you don’t recognize; the “within 60 days of your statement” clock on debit cards is the one to beat.
• Report it at ReportFraud.ftc.gov and tell the city’s parking office where the sticker is so they can pull it (FTC, Sept. 3, 2026).

The takeaway

Meters took coins long before they took cards. The QR code is the newest way to pay, and the only one a stranger can replace with a sticker. When in doubt, the keypad works fine.

This is information, not financial or legal advice. Card-liability rules are federal minimums; your card issuer’s own policy may be more generous. Talk to a licensed professional about your situation.

Want the plain-English version of the week’s scams and money news? Join the free Senior Savers newsletter. No sales calls, ever. You’ll hear from us only when you ask to.