Fake QR Code Stickers Found on Wellington Parking Meters
Criminals stuck fraudulent QR codes over real ones on parking meters across New Zealand's capital. Scanning them could send your payment to the wrong place entirely.
Key points
- Wellington City Council parking staff removed about a dozen fake QR code stickers from parking meters across the city.
- Police have urged Wellington residents to check any parking meter QR code carefully before scanning or paying.
- The scam uses a tactic called QR code phishing (sometimes called "quishing"), where a fake code redirects people to a fraudulent payment page.
- No figure for total financial losses has been released publicly at time of writing.
About a dozen fake stickers have been pulled off parking meters in Wellington, with more potentially still in place across the city. Wellington City Council confirmed its parking staff found and removed the fraudulent codes, while police are now asking residents to stay alert.
What exactly happened?
Someone printed fake QR codes, which are those small square barcodes you scan with a smartphone camera, and stuck them over the legitimate ones on parking meters. A driver who scanned one of the fake codes and entered their payment details would likely send money directly to whoever placed the sticker, not to the council.
This type of scam has appeared in cities across the United Kingdom, the United States, and Australia over the past few years. Wellington is among the first New Zealand locations to see it confirmed at scale, as first reported by RNZ.
Should Wellington drivers be worried?
Yes, but the fix is simple. Before you scan any QR code on a parking meter, look closely at the sticker itself. A fake one is often a printed label placed on top of the original surface. If the code looks like it has been stuck over something, or if the sticker feels raised or peels at the edges, do not scan it.
Also check where the code actually takes you. When you point your phone camera at a QR code, most smartphones show you the web address before you open it. If that address looks unfamiliar or does not include an official council or known payment-provider domain, stop and walk away.
| What to check | What to look for |
|---|---|
| Physical sticker | Edges peeling, layered on top of original surface |
| Web address shown | Official council or payment provider domain only |
| Payment page | No request for unusual personal details |
| Meter display | Cross-check price and reference with screen readout |
If you have already scanned a suspicious code and entered card details, contact your bank immediately to flag the transaction and request a new card.
How do criminals pull this off?
The attack requires almost no technical skill. A small printed sticker costs very little to produce, and a busy car park gives criminals cover to place them quickly without attracting attention. The real damage happens at the payment stage, when a convincing fake webpage captures your card number, expiry date, and security code.
Wellington City Council has not said whether any payments were successfully diverted before the stickers were discovered. Police investigations are ongoing.
Anyone who spots a suspicious QR code sticker on a Wellington parking meter is asked to report it to Wellington City Council or New Zealand Police directly, rather than removing it themselves, so evidence is preserved.
