QR codes under the council's domain
If every official code comes from aj.elmunicipio.cat, citizens have a clear reference point. A sticker that leads to another domain gives itself away.
🅿️ Documented case
The parking meter QR code scam, explained
It is the most cited example of quishing in Spain and the easiest to understand: a sticker with a fake QR code, placed over the legitimate code on a parking meter. Someone who wants to pay for parking scans it in good faith and ends up leaving their card details on a website imitating the city council's. INCIBE, Spain's National Cybersecurity Institute, has documented it as one of the most common vectors.
The scam, step by step
How a sticker that costs two euros diverts the payment
1
The fake sticker
The scammer prints a QR code that points to a website they control and places it right over the legitimate code on the parking meter. Visually, it is indistinguishable.
2
The cloned website
The code leads to a page that copies the look of the city council or the payment gateway, with the right logo and colours.
3
The stolen data
The driver “pays for parking” and, without knowing it, hands over their card details. The actual parking payment is never even made.
The same pattern has been seen, according to INCIBE, on café terraces and EV chargers: anywhere a QR code invites you to pay is a target.
What INCIBE says
Not an isolated case, but a documented vector
Spain's National Cybersecurity Institute has warned about QR code fraud and identified this as the most common vector in Spain: fake stickers placed over legitimate QR codes on parking meters, café terraces and EV chargers, impersonating city council websites and payment gateways. We use the institutional source on purpose: it is a finding by a public body, not a figure from a security vendor.
INCIBE — fraudulent QR codes (in Spanish) ↗ · INCIBE — quishing campaign notice ↗
The honest answer
What a city council can do (and what nobody can do)
Let us start with what is honest: nobody can physically stop someone from sticking a label on a meter. What can change is who is able to prove what is legitimate.
Verifiable codes
With a signed QR code, a municipal technician, a journalist or a concerned citizen can use a public verifier to check that the legitimate code belongs to the council. The fake sticker fails the check.
Communication and inspection
Tell citizens that the codes can be verified, and regularly inspect street furniture to spot stickers placed on top of the originals. Technology helps; it does not replace vigilance.
Let us be clear: a signed QR code does not prevent the attack — a scammer can always print their own code — but it stops the attack from passing itself off as the city council for anyone who bothers to check. It is a layer of trust and incident response, not an antivirus.
Frequently asked questions
Common questions
How does the parking meter QR code scam work?
The scammer prints a sticker with a QR code and places it over the legitimate QR code on the parking meter. Someone who wants to pay for parking scans the fake code, lands on a website imitating the city council or the payment gateway, and enters their card details, which end up in the fraudster's hands.
What has INCIBE documented about this scam?
INCIBE, Spain's National Cybersecurity Institute, has warned about QR code fraud and pointed to its most common vector in Spain: fake stickers placed over legitimate QR codes on parking meters, café terraces and EV chargers, impersonating city council websites and payment gateways.
Does a signed QR code stop someone from putting a fake sticker on top?
No: nobody can physically prevent someone from sticking a label on a meter. What a signed QR code under the council's own domain provides is that citizens, technicians or journalists can check that the legitimate code belongs to the council, and that the fake sticker does not.
What can a city council do to protect itself?
Publish all public-space QR codes under its own domain, sign them so they can be verified, tell citizens that they can be checked, and regularly inspect street furniture to spot stickers placed on top of the originals.
Keep reading
QR security cluster
From the problem to the operational response.
Municipal QR codes that citizens can verify
Signed, under the council's own domain and with a public verifier. It is the answer to the fake stickers on parking meters: it does not prevent the attack, but it stops anyone impersonating the administration unnoticed.