The Sticker on the Meter: Why Every QR Code Deserves a Second Look

A driver pulls into a municipal garage in a mid-sized American city, finds the payment kiosk marked with a laminated sticker, and does what the sticker asks: points a phone at the square of black-and-white pixels and taps the link that appears. A payment page loads, styled in the colors of a familiar processor. The fee is small — four dollars, maybe six. Most people would not think twice, and that is precisely the design.

This is quishing, the industry's inelegant shorthand for phishing delivered through a QR code. The technique is not new, but its center of gravity has shifted. Codes that once appeared mainly in email attachments now decorate parking meters, restaurant tables, package notices, utility bills, and the placards taped inside gas-station pump doors. The FBI's Internet Crime Complaint Center issued a public warning about malicious QR codes as far back as 2022 and has revisited the subject since, while the Federal Trade Commission has cautioned consumers directly about codes posted in parking lots and on public signage.

Why the Square Works Better Than the Link

An emailed phishing link arrives with context. The address bar exists, a sender name sits above it, and anyone who has sat through a corporate security module knows to hover before clicking. A QR code strips that context away. The destination is invisible until the phone has already resolved it, and by then the browser is open. On mobile, the address bar is short, frequently truncated, and easy to misread — and mobile browsers display far less of the warning scaffolding that desktop users have learned to recognize.

There is a physical dimension as well. A decal on a meter carries an implicit endorsement. Someone official put it there, the reasoning goes, and someone official is the city, and the city would not install a scam. Attackers understand that inference and exploit it. Printed stickers that mimic municipal signage are inexpensive to produce, and a kiosk that already accepts cards but also displays a code lends the fraud a veneer of redundancy rather than suspicion.

Three Settings Worth Watching

Parking infrastructure. Meters, garages, and pay stations are the current favorite because the transaction is small, urgent, and near-universal in American cities. A driver who is already late does not comparison-shop a payment page.

Hospitality. Tabletop codes for menus and ordering became ordinary after 2020. A replacement sticker laid over the original is difficult to spot in a dim dining room, and customers have been trained to expect the ritual.

Delivery and billing. Cards left on doorsteps about a missed package, and letters styled as utility notices, run on the same logic: a small, time-limited problem the recipient wants resolved immediately.

What a Careful Scan Actually Looks Like

The defensive habits here are modest and require no technical skill. Where a business offers both a code and an official app, prefer the app. Where a code resolves to a page requesting card details, check whether the address contains the organization's genuine domain rather than a lookalike assembled from extra hyphens or a swapped character. Most phones now preview the destination before opening it; that preview is worth two seconds of attention.

Two further habits are worth institutionalizing. First, never scan a code that arrives unsolicited by text or email, particularly when it is attached to a threat — a suspended account, an unpaid toll, a package on hold. Second, treat any payment page that demands more than the transaction requires as a stop sign. A parking fee does not need a Social Security number, a full billing address, or a login to an unrelated account.

The Institutional Half of the Problem

Consumer vigilance only goes so far when the physical environment itself has been compromised. Municipalities and private operators that install codes should inventory them, use tamper-evident decals, and publish their official payment domains on their own websites so residents have an independent reference point. Businesses that refresh tabletop codes should date and initial them. Payment processors can help by making hosted checkout pages unmistakably branded, narrowing the space a lookalike page can occupy.

There is also a reporting gap. A four-dollar fraudulent charge is rarely reported to police, which means the aggregate scale of quishing is systematically undercounted in the statistics that shape enforcement priorities. Complaints filed with the FTC and the FBI's complaint center become the evidence base for future action, and they exist only if people take the trouble.

Convenience Without Paranoia

The reasonable conclusion is not to stop scanning codes. They are genuinely useful, and refusing them outright would be a small act of self-harm in a world that increasingly treats a camera as a keyboard. The reasonable conclusion is that a code is a claim, not a credential. It asserts a destination, and the person holding the phone is entitled to verify it.

The four dollars is almost beside the point. The card number entered on a convincing payment page is the real prize, and it can be reused long after the meter has moved on to its next customer. A glance at the address costs nothing. Skipping it can cost considerably more.