FTC QR code scam alert (2023) and the Texas parking meter stickers

Consistent with FTC and FBI guidance, scammers typically select high-footfall public payment infrastructure such as on-street parking meters, or draw on commonly effective phishing pretexts (failed package delivery, locked account, suspicious sign-in) that work at mass scale over email and SMS, rather than researching any specific individual victim.

Before deployment, scammers likely register look-alike or throwaway domains, such as the fake "passportlab.xyz" payment site documented in the Texas parking-meter incidents of December 2021 and January 2022, and build spoofed login or payment pages designed to mimic the legitimate service.

Code fabrication, as described in the agencies' guidance rather than reconstructed from a specific case: scammers print physical QR-code stickers styled to pass a casual glance as official signage, or embed a malicious QR code as an image inside a phishing email or text so the destination URL is hidden from automated, text-based link scanners, a technique Ars Technica's Dec 2023 reporting specifically flagged as evading anti-phishing filters.

in the Texas incidents the sticker was physically affixed over the legitimate QR code on a parking pay station; in the email and text vector the FTC describes, the message is sent at mass scale using a fabricated urgent pretext designed to discourage careful inspection before scanning.

Victim scan and redirect, per the FTC's and FBI's description of the mechanism: the victim scans the code with a phone camera or QR app, which opens the encoded URL, taking the victim to a spoofed site or triggering a malware download. Whether any specific person reached the fake passportlab.xyz page was never established.

Credential or payment harvesting, the intended outcome in both agencies' guidance but not documented as completed anywhere in this case: the guidance describes a victim entering login credentials or personal information on the spoofed page, or a device compromised by malware installed during the redirect. Ars Technica, the only source that looked for victims in the Texas incidents, reported that it is not clear how many people, if any, were tricked into paying.

Monetization and follow-on fraud, inferred from the guidance rather than observed: the FBI's January 2022 IC3 announcement describes cybercriminals redirecting payment and using stolen login and financial information to withdraw funds from victim accounts, which is where the payment-fraud and identity-theft objectives in this file come from. The FTC alert mentions none of that. No monetization was documented in the Texas incidents or in either agency's guidance.