Fake QR code stickers found on parking machines in Mississauga and Kelowna
The City of Mississauga warned drivers on April 24 not to scan QR codes on its parking machines after staff found about 80 fraudulent stickers on downtown Pay and Display units. The codes led to third-party payment sites unconnected to the city.
It is the latest in a string of "quishing" incidents in Canadian cities. A QR code hides its destination until it is scanned, which makes it an easy way to steer people to a fake payment page, and a sticker costs almost nothing to print.
What happened
Mississauga said it learned of the stickers on April 22 and removed them within an hour, then sent crews to check every parking machine, according to the city's notice. It said QR codes are never used to collect parking payments; the only legitimate method is the machine's own screen, which takes coins, cards and mobile wallets. The city said similar scams have been reported in Vancouver, Montreal, Ottawa and Toronto. CTV News also reported the warning.
In February, Kelowna parking staff found unauthorized decals on about 75 pay stations the morning after they were put up on Feb. 11. The decals carried part of the PayByPhone logo, and the company blocked the fraudulent website, the City of Kelowna said. Kelowna RCMP opened a fraud investigation and sought three men seen on security video, Castanet reported. The city noted that drivers who paid a fake site could also have received a parking ticket.
Why it matters beyond parking
The same trick works on anything with a printed code: restaurant menus, invoices, delivery notices and posters in a shop window. Businesses that use QR codes for payments or menus should check them, because a sticker over a legitimate code can send customers to a fraudster under the business's name.
What to do
- Do not scan QR codes on parking machines. Pay at the machine or through the official app downloaded from your phone's app store.
- Before entering card details after scanning any code, check that the web address is the one you expect.
- Businesses should inspect their own printed QR codes regularly and print codes directly on materials rather than as stickers where possible.
- If you paid a suspicious site, call your card issuer right away, report it to the city (311 in Mississauga) and file a police report. Report it to the Canadian Anti-Fraud Centre as well.
