Parking QR-Code Scam? Verify the Payment Before Entering Your Card

You park, spot a scan-to-pay sticker and reach for your phone. Before entering your card, check who actually operates the space. A sticker attached to a real parking machine can still send your payment to a fake website.

If you are unsure, stop using the code and reach the parking operator independently. Use its verified website, established app or the machine’s official payment instructions. If you already entered financial information, contact your bank or card issuer promptly—not the help number on the suspicious page.

A real machine does not make every sticker legitimate

In its April 24, 2026 warning, Mississauga reported unauthorized QR stickers directing drivers to unrelated payment sites. The city says QR codes are not a payment method at its City parking machines: use the digital screen’s payment prompts instead. Report suspicious codes there to 311.

That is a specific local rule, not proof that every parking QR code in Canada is fake. Calgary Parking uses approved QR codes in some official locations, while warning against added or altered stickers. The important check is the operator’s actual payment method—not whether a code looks neatly printed.

Before paying: use a route you can verify

• Identify the operator and the exact lot, machine or parking zone. Do not assume the neighbouring lot uses the same company.
• If a sticker looks added over instructions or another code, leave it alone and use an independently verified payment route.
• Open the parking app you already know, or navigate from the operator’s official website. Do not install an unfamiliar app merely because a sticker tells you to.
• Check the licence plate, location and parking period before confirming a genuine transaction; keep the confirmation.

The Canadian Centre for Cyber Security explains that QR codes can lead to convincing imitation sites or trigger other actions. It recommends verifying questionable labels with staff and typing a known website address instead of prioritizing convenience. A professional-looking logo alone is not an independent check.

For a hospital, event or private lot, find the operator through the facility’s official parking information. Ask which payment channel applies to that lot. If you cannot establish a safe way to pay, contact the operator or use another lawful parking location rather than assuming the suspect sticker makes the space free.

An unexpected ticket text is a separate warning

The City of Toronto says it does not send parking-ticket text messages or email reminders, including through third parties. Start a Toronto violation lookup from the city’s own website rather than a link in an unexpected payment demand. Legitimate correspondence about a dispute is a different matter; verify it through your existing case and official contact route.

Calgary distinguishes unsolicited fine demands from its customer-initiated Call or Text to Park service.

Verify suspicious printed notices through the issuer’s independent official system, not the notice’s own payment link.

No online record does not automatically mean a fake ticket

Toronto warns that handwritten notices can take 5–10 days to appear in its lookup. Calgary also advises that a newly issued ticket may not appear immediately. Contact the genuine issuer if uncertain, and track the real payment or dispute deadline. A failed first search is not permission to ignore a notice.

Already scanned? Respond to what happened

Opened the page but entered nothing: close the suspicious page and stop interacting with it. The Cyber Centre recommends keeping devices updated and preventing QR actions from launching automatically. If you downloaded software or granted permissions, seek trusted device-security help rather than following instructions from the same page.

Entered card details or sent money: the Canadian Anti-Fraud Centre says to contact the financial institution or payment provider as soon as possible. Explain what you entered and ask what protection is needed. Use a contact route you independently trust. Do not wait for a second charge before reporting.

Entered an account password: change it through the genuine service, and change it anywhere else you reused it. Monitor financial accounts if payment details were involved. Do not send another payment to a supposed support agent to unlock a refund.

Keep evidence without revisiting the trap

Save the available URL, screenshots, receipt, transaction record and any messages. Record the parking location and time; photograph the suspect sticker and surrounding machine only if safe. Report the equipment issue to the parking operator so it can investigate.

Report fraud or attempted fraud through the national Report Cybercrime and Fraud system linked by the Canadian Anti-Fraud Centre. If you were a victim, also contact local police. A bank report, parking-operator report and police report serve different purposes; none guarantees reimbursement or cancels a genuine parking charge.

Before walking away: confirm with the real operator that your parking session is valid. A receipt from a fake page is not reliable proof that the legitimate operator received payment.

Official Canadian sources checked November 1, 2026. Payment methods and reporting procedures vary by operator; the municipal examples above are not nationwide rules.