Fake QR Code Stickers Found on Wellington Parking Meters
Criminals stuck fraudulent QR codes over real ones on parking meters across New Zealand's capital. Scanning them could send your payment somewhere it was never meant to go.
Key points
- Wellington City Council parking staff removed about a dozen fake QR code stickers from parking meters across the city.
- Police have urged Wellington residents to check any parking meter QR code carefully before scanning.
- The scam uses QR code phishing, sometimes called "quishing", where a fake code redirects people to a fraudulent payment page.
- No figure for total financial losses has been released publicly.
About a dozen fake stickers have been pulled off parking meters in Wellington, with more potentially still in place. Wellington City Council confirmed its parking staff found and removed them, and police are asking residents to take care.
What exactly happened?
Someone printed fake QR codes, the small square barcodes you scan with a smartphone camera, and stuck them over the legitimate ones on parking meters. Scan one of the fakes, enter your card details, and your money goes to whoever placed the sticker, not the council. As we reported on 17 July, Christchurch saw the same tactic weeks before Wellington, making this the second confirmed New Zealand city to deal with the problem.
Should Wellington drivers be worried?
Yes, but the fix isn't complicated. Before scanning, look at the sticker itself. Fakes are often printed labels placed over the original surface. If it feels raised or peels at the edges, don't scan it.
Also check where the code takes you. Most smartphones show the web address before opening it. If that address doesn't match an official council or recognised payment-provider domain, stop and walk away from the meter entirely.
| What to check | What to look for |
|---|---|
| Physical sticker | Edges peeling, layered on top of original surface |
| Web address shown | Official council or payment provider domain only |
| Payment page | No request for unusual personal details |
| Meter display | Cross-check price and reference with screen readout |
If you've already scanned a suspicious code and entered card details, contact your bank immediately to flag the transaction and request a new card.
How do criminals pull this off?
Very little skill is required. A printed sticker costs almost nothing to produce, and a busy car park gives cover to place them quickly. The damage happens at the payment stage, when a convincing fake webpage captures your card number and security code.
Wellington City Council hasn't said whether any payments were successfully diverted before the stickers were discovered. Police investigations are ongoing.
Anyone who spots a suspicious sticker on a Wellington parking meter should report it to the council or New Zealand Police rather than removing it, so evidence is preserved.
The pattern here is worth watching. Two New Zealand cities in under two months suggests either a coordinated campaign or copycat activity spreading along familiar commuter corridors. Either way, councils relying on QR codes for parking payments now have a physical security problem that no software patch will fix.
