Orlando police pulled about 200 fake QR stickers off downtown parking meters in June 2025. How to spot them: white sticker, peels off. No losses confirmed.
Social Engineering Examples·9 sources
In June 2025, Orlando police warned that someone had stuck fake QR-code stickers over the genuine ParkMobile codes on parking meters across downtown Orlando. Parking enforcement pulled about 200 of them. Police said a scan led to a fraudulent site that asked for personal and financial information. No victim was ever confirmed and no loss was reported. Status: Police warning; no loss on record.
Downtown parking enforcement found the stickers, and the Orlando Police Department posted a warning on Monday 2 June 2025. Orange Avenue was one of the spots. Police described the codes as "designed to look legitimate while redirecting users to a fraudulent site."
Worth being clear: what's on record is stickers found, not money gone. No source records anyone scanning a fake code, entering details or losing money, and no source describes the fake website. Police didn't say how many meters were affected or how long the stickers had been there. No suspect was named and no arrest was made.
OPD Financial Crimes Sgt. Michael Fiorentino-Tyburski explained the difference: "The legitimate QR code from Park Mobile is printed directly onto the sticker and has a green background. One of the fraudulent stickers, which has been placed over it, is on a white background and easily peels off."
| Real ParkMobile code | Fake | |
|---|---|---|
| Background | Green | White |
| How it's attached | Printed into the decal | A separate sticker on top |
| Peels off? | No | Yes, easily |
| Branding | City and vendor | None |
Funny thing is, the fake barely tried. It didn't have to. Slap it on a city meter and people assume it's the city's.
Tip: give the code a quick rub with your thumb first. Feel an edge, or see it lift? Someone's been at it.
Police said officers were working with the city parking division to inspect every downtown meter and remove any remaining fakes. ParkMobile told FOX 35 that if anything looks wrong, users should skip the QR code and enter the zone number in its app.
The longer-term fix was structural. In July 2026, the city began removing parking meter heads across downtown, planning to take out all of its roughly 1,000 meters by 1 October and move drivers to the app, pay-by-text or a phone number. No meter, no sticker.
See also quishing and the UK car park QR scams, where the same trick spread across more than 100 councils.
Someone covered the real ParkMobile codes on downtown meters with their own stickers in mid-2025. Police said a scan took you to a bogus site fishing for card and personal details.
About 200 were recovered by parking enforcement. Police didn't say how many were placed in total.
No victim or loss was ever confirmed in public reporting.
In Orlando, the real code was printed on a green background, and the fake was a white sticker on top that peeled off. In general, avoid any code that's a separate sticker.
Social Engineering Examples. “Orlando parking meter QR sticker scam (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/orlando-parkmobile-qr-parking-meter-sticker-scam-2025
Unknown suspects produced QR-code stickers on plain white adhesive stock encoding a fraudulent URL. Nothing beyond that is sourced. OPD said only that unknown suspects had been placing fraudulent QR codes over the legitimate QR codes on the parking meters, and no source describes who they were, how the stickers were produced, or what infrastructure sat behind the URL.
Nothing a city or a payment vendor controls prevents someone printing an adhesive QR sticker, so there is no meaningful control at this stage. The practical controls sit at Stages 2 and 3.
The counterfeit stickers were applied directly over the genuine green-background ParkMobile decals on meters across downtown Orlando, with reported locations including Orange Avenue. Authorities did not confirm how many meters were affected or how long the scam had been operating, so the placement window is unknown.
Routine physical-audit patrols of public QR codes, which is what downtown parking enforcement did here, and tamper-evident decal stock that visibly voids or discolors when lifted, make an overlay either harder to apply cleanly or faster to find before many drivers scan it.
OPD said a device that scans one of the counterfeit codes is directed to a fraudulent site instead of to the legitimate parking site parkmobile.io. No source records any driver actually scanning one.
Public guidance to inspect the decal before scanning, since the genuine code is printed directly onto a green background while the counterfeit was a white sticker that peels off, and to open the official app and enter the zone number instead of scanning an unfamiliar code. The durable version of this control is not scanning at all: the city now uses no QR codes on parking signage, so any code found on one is by definition not the city's.
OPD said the fraudulent site asks for financial information, and that a user's personal information can be stolen there. The site was never described, named or attributed publicly, and no driver was confirmed to have submitted anything or lost money, so the chain is documented as far as the capability and no further.
Card monitoring and prompt reporting of unrecognized charges, which the vendor's own guidance recommends, limit the damage if anyone did submit details. No such loss was ever confirmed in this case.
Browse by what this case has in common with others in the library.
In 2025 the FBI, FTC and USPIS warned of unordered packages with QR codes that lead to phishing sites or…
Fake QR stickers on UK council parking machines sent drivers to cloned payment sites. 123 of 373 councils were hit…
Employees scanned a QR code in a fake Microsoft MFA-setup PDF and gave up passwords on a cloned login. How…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A 2025 campaign faked Portugal's tax authority and asked victims to paste a command to 'enable file preview', starting a…
Anthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most…
DOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records…
Dubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters.…
Between 2006 and 2008 the FTC pursued six civil cases covering 16 data-broker and private-investigation defendants after two dismissals, alleging…
A Singapore businessman sent at least S$4.9M after a fake Zoom "government meeting" built from real footage of PM Lawrence…
The Caesars breach began in August 2023, when someone called its outsourced IT help desk, said they were an employee,…
Two unencrypted TD Bank backup tapes carrying data on 260,000 customers vanished in transit between Massachusetts offices in 2012.
DOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records…
Police say a gang turned photos into AI blinking clips to beat Aadhaar face checks, hijack linked phone numbers and…
A caller posing as Carnival's IT security team got an employee's login in April 2026. The attacker copied data on…
The SEC's 2018 Section 21(a) report detailed how fake-executive and fake-vendor BEC emails caused nearly $100 million in combined losses…
Impersonators posing as two Philadelphia school vendors asked to switch from cheque to ACH and diverted nearly $700,000 in 2024.…
A compromised email sent a Wheeling, WV nonprofit a fake solar panel invoice. It paid $30,750 to an Oklahoma man's…
Spoofed emails impersonating Medidata's president, backed by a fake "lawyer" caller, tricked finance staff into wiring $4.8M to an overseas…
JLR's 2025 cyber attack halted production for five weeks. Early reports blamed help-desk vishing; JLR's CISO later denied it. What's…
Attackers made Microsoft's own Azure Monitor send a fake $459.90 Windows Defender bill that passed SPF, DKIM and DMARC. A…
The FBI's 2025 Internet Crime Report tracked AI fraud for the first time: 22,364 complaints and $893M lost. What the…
Social Engineering Examples