Fake QR code stickers on Christchurch parking meters are stealing payments

Key points

• Fraudulent stickers bearing fake QR codes, meaning scannable square barcodes that open a website on your phone, appeared on Christchurch parking meters on 14 July 2026.
• Both public and private parking machines were targeted across the city.
• The stickers directed drivers to fake payment websites built to collect money and card details.
• The Christchurch City Council issued a public warning the same morning the stickers were discovered.
• No QR code on a Christchurch parking meter should be trusted until the council confirms otherwise.

Someone got up early with a roll of stickers and a plan.

On the morning of 14 July 2026, council workers found fraudulent stickers plastered over the payment panels of parking meters around Christchurch. The stickers carried QR codes that led drivers to fake websites built to look like legitimate parking payment pages.

Pay through one of those pages and your money goes to the scammers. Your card details likely go with it.

This kind of attack has a name in security circles: quishing, which is phishing (tricking someone into handing over money or personal details) carried out through a QR code rather than a link in an email. The mechanics aren't new. What's different here is that someone had to walk up and stick the fake code on the real machine, making this a targeted, on-the-ground operation rather than a mass email blast.

First reported by NZ Herald, the scam hit both council-operated and privately run parking machines, suggesting the people behind it scouted the city rather than picking targets at random.

Should drivers worry about their card details?

Yes, if you scanned a parking meter QR code in Christchurch on or around 14 July 2026, act now. Contact your bank, explain that you may have entered your card details on a fraudulent website, and ask them to monitor your account or reissue your card.

If you paid and the transaction went through, report it to your bank as an unauthorised payment. Keep a record of the amount and the time.

For everyone else: pay at the machine's keypad or touchscreen directly, using the instructions printed on the meter itself. Don't scan any QR code on a parking meter until the council confirms the machines are clear.

This attack needs almost no technical skill. Print a sticker, place it on a machine, collect payments. The "AI-powered" label some outlets reach for in cases like this doesn't apply. It's fraud with adhesive backing, and it works because people are in a hurry and QR codes have trained us not to think twice. That habit is worth breaking.

The Christchurch City Council hadn't confirmed by publication time how many meters were affected or whether any had been fully cleared.