ParkMobile scam

How to tell

In order. The first one holds even when the rest of the message looks completely real, which is the situation most people are actually in.

1. The QR code is a sticker sitting on the sign rather than printed as part of it.

   ParkMobile’s own guidance is to look closely and make sure the code is part of the official meter or sign and "not just stuck on". This is first because it is the only tell available before you scan, and scanning is the whole attack. It also works when you genuinely are parking, genuinely do owe for the space, and genuinely do use ParkMobile, which is most people reading this.

2. A QR code hides where it is sending you.

   None of the usual advice about reading a link before you click it applies, because there is no link to read until you are already on the page. The FTC’s advice is to inspect the URL your reader previews and check it for misspellings or switched letters before opening it. If your phone shows no preview, you have no tell left at that point, which is why the sticker check comes first.

3. The page that opens is not on parkmobile.io.

   ParkMobile’s web app runs at app.parkmobile.io, and its guidance is to treat any other domain as a reason to close the browser. A page on a different address is not ParkMobile’s however closely it copies the look, and card details entered into it go to whoever built it. Check this after the fact if you scanned something: it tells you whether to call your bank.

What ParkMobile actually does

You never need the code on the sign. Open the ParkMobile app yourself and type in the zone number printed on the meter or the sign, which is exactly what ParkMobile tells customers to do when a code looks wrong, or go to parkmobile.io yourself. If you would rather not use the app at all, pay at the meter.

Where to report it

The city or agency that owns the meter

ParkMobile’s guidance is to report an unusual QR code sticker to the city so it can be investigated and removed. Note the meter or zone number and where it is, so the next driver does not scan it.

The Federal Trade Commission

Report it at ReportFraud.ftc.gov, which is the FTC’s own reporting site.

Your bank, if you entered card details

Call the number on the back of your card, not any number from the page, and ask them to stop the card and review recent transactions.