Protect Printed QR Codes From Sticker Scams: What Cities Did

To protect printed QR codes from sticker scams, copy what cities did when fake codes appeared on parking machines: say publicly which payment methods are real, inspect every unit, remove fakes fast, warn the people who use the service and give them a way to report. No source reviewed here tested tamper-evident labels, frames or covers, so none of those can be called proven.

The cases below are public parking equipment, not business print. The mechanism is the same (a criminal's code placed over a real one), but applying it to your own signs is our reading. For the consumer side, see How to Spot a Fake QR Code.

Facts checked on 17 October 2026.

Three cases: New York, Mississauga and an FTC alert

Five things the officials did

1. Said which payment method is real. NYC DOT named the official ParkNYC app and physical meters as the only way to pay for metered parking. Mississauga wrote: "QR codes have never been a legitimate method of payment at City parking machines." Which? reported in June 2025 that Southend-on-Sea City Council likewise uses no QR codes on its parking machines. For a business, the equivalent is a line on your website and receipts saying what your codes do and do not do.
2. Inspected everything and removed fakes quickly. New York began a citywide inspection; Mississauga sent crews to check every machine. Cyber Security NSW advises organisations to "regularly check deployed QR codes for any signs of tampering or misuse" (undated sheet; its PDF metadata and web address point to October to December 2024). Found a suspect sticker? The free QR code reader decodes a photo in your browser and shows the address without opening it.
3. Warned users where they already are. New York said ParkNYC users would receive an in-app notification. Mississauga listed warning signs, including a sticker placed on or near the machine rather than built into it, and a payment site with a slightly different address.
4. Gave people a way to report. New York listed a ParkNYC phone number and email, Mississauga asked residents to call 311, and the FTC points people who scanned a bad code to ReportFraud.ftc.gov. A January 2026 FBI FLASH, written about email quishing rather than stickers, also advises organisations to set up "clear protocols for reporting suspicious QR codes".
5. Told the police. NYC DOT said it notified law enforcement.

What the numbers say

Figures are scarce, and they count different things.

The two Action Fraud periods differ, and neither page is Action Fraud's own. Do not add rows together: they count reports, attack volumes, unique codes and crawler detections. None breaks out stickers on physical signs.

Official and vendor pictures differ. The UK's National Cyber Security Centre said in a February 2024 blog that QR-enabled fraud in the UK "is relatively small compared to other types of cyber fraud" and that most of it tends to happen in open spaces such as stations and car parks. Vendor numbers cover different quarters: Mimecast's count fell in Q4 2025, while Microsoft reports growth in email over Q1 2026. No source here measures how often printed codes get covered.

How to protect printed QR codes from tampering: what is proven and what is not

No source reviewed here tests tamper-evident stickers, borders, clear covers or any other physical protection, and no official page reviewed here recommends one. Steps 1 to 5 are what the sources support; the rest is a limit or an unproven idea.

A dynamic code does not stop a sticker. A fake sticker carries its own address, so nothing you edit in an account changes what it encodes. A dynamic code covers the other half of the problem. With a dynamic URL code in QR Maker AI, the printed pattern encodes a short link, and you can change the destination behind it from the next scan, without reprinting, if your landing page is compromised or moves. The APWG report notes that criminals also use generators' destination-editing and scan-tracking features, so neither is a safeguard by itself. You can create a dynamic code to see how editing works.

Idea 1, unproven: watch scan counts. Bitly's trust and safety product manager suggests that a physical code whose scans suddenly drop to zero "may have been tampered with or covered by a fraudulent code." It is a vendor suggestion with a hypothetical example and no data, and it will raise false alarms: a season ends, a campaign closes, a sign moves. Treat a drop as a reason to walk over and look. On our free plan, counting pauses once an account passes 500 tracked scans in a month while codes keep redirecting, so a flat line late in the month may be the cap, not a sticker. See How to Track QR Code Scans.

Idea 2, unproven: use a domain people recognise. Unit 42, a security vendor, wrote in April 2025 that "people can only view the domain name through their smart device's camera application," with no method given. If so, a code that opens a domain you own, such as go.example.com, gives scanners something familiar to compare. That is our inference, and no source reviewed here tested it. The Business plan includes one custom short-link domain on a subdomain you own (pricing).

Idea 3, unproven: print the code into the sign. Mississauga treats a sticker on or near a machine, rather than built in, as a warning sign, and the NSW sheet says an overlaid code can sometimes be seen or felt. If your real code is printed on the sign itself, anything stuck on top should stand out more. No source tested whether that deters anyone.

FAQ

Can a dynamic QR code stop someone placing a sticker over it?

No. A sticker encodes its own address, so a dynamic code only lets you change where your own code points.

Is there a tamper-proof QR code sticker?

None of the official pages reviewed here evaluate tamper-evident stickers, frames or covers, so this article cannot recommend one. The cities relied on inspection, fast removal and public warnings.

What should I do if I find a fake sticker over my code?

The cities removed the stickers and warned users, and New York notified law enforcement. In the United States, the FTC tells people who scanned a bad code to report it at ReportFraud.ftc.gov.

Sources

1. NYC DOT — NYC DOT Issues Parking Meter Scam Advisory. Published 6 June 2025. Accessed 17 October 2026.
2. City of Mississauga — City warns about fraudulent QR codes on parking machines. Published 24 April 2026. Accessed 17 October 2026.
3. Federal Trade Commission — See a QR code parked somewhere? Don't scan it…yet!. Published 3 September 2026. Accessed 17 October 2026.
4. Which? — Quishing scams warning: how to spot and avoid dodgy QR codes. Published 25 June 2025. Accessed 17 October 2026.
5. Cyber Security NSW — Quick Response (QR) code Fact Sheet. Undated; PDF metadata and web address point to October to December 2024. Accessed 17 October 2026.
6. Federal Bureau of Investigation — North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities. Published 8 January 2026. Accessed 17 October 2026.
7. Croft Parish Council — New quishing alert: £3.5 million lost last year to fraudulent QR codes. Published 15 July 2025 (reposts an Action Fraud notice). Accessed 17 October 2026.
8. Federal Bureau of Investigation — 2025 IC3 Annual Report. Undated in the PDF text. Accessed 17 October 2026.
9. Microsoft Threat Intelligence — Email threat landscape: Q1 2026 trends and insights. Published 30 April 2026. Accessed 17 October 2026. (vendor data)
10. APWG — Phishing Activity Trends Report, 4th Quarter 2025. Published 18 February 2026. Accessed 17 October 2026. (vendor data, from member Mimecast)
11. Palo Alto Networks Unit 42 — Phishing on the Edge of the Web and Mobile Using QR Codes. Published 13 February 2026. Accessed 17 October 2026. (vendor data)
12. National Cyber Security Centre (UK) — QR Codes - what's the real risk?. Published 8 February 2024; page metadata shows a March 2025 update. Accessed 17 October 2026.
13. Bitly — How Dynamic QR Codes Help Businesses Fight Fraud (From an Expert). Published 22 May 2025. Accessed 17 October 2026. (vendor data)
14. Palo Alto Networks Unit 42 — Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon. Published 1 April 2025. Accessed 17 October 2026. (vendor data)