QR Codes to Steal your Money: Beware While Parking Cars

In recent incidents reported across the United States and the United Kingdom, scammers have resorted to leaving counterfeit parking tickets on drivers’ windshields.

Woman who scanned QR code with malware lost $20k to bubble tea survey scam while she was sleeping https://t.co/gH4hZ4oQTa

— The Straits Times (@straits_times) May 6, 2023

One such occurrence was discovered by a Reddit user who stumbled upon a fake parking ticket claiming to be issued by the San Francisco city government. The vigilant user promptly shared a warning, emphasizing that legitimate citations from the San Francisco Municipal Transportation Agency (SFMTA) would not bear the city logo. The user also cautioned against scanning the QR code on the ticket, as it allegedly led to unauthorized access to the recipient’s bank account.

Of interest, the fraudulent ticket was dated in the future (May 5th) despite being observed before that date, which should raise suspicion.

Source: Reddit user

The QR code printed on the ticket directed individuals to a now-inactive URL shortener link (hxxps://qr.link/g43phs). This link, in turn, purportedly redirected users to hxxps://sfmta-project. vertical. app, an illicit website meticulously designed to mimic the appearance of the official SFMTA website. The aim was to deceive unsuspecting victims.

KRON4, a San Francisco-based TV channel, corroborated with SFMTA and confirmed the ticket’s falseness. They also highlighted the striking similarity between the fraudulent website.

Additionally, observant netizens noticed that the counterfeit website employed Square’s web payment form to process fraudulent transactions. Both the illicit domains and the associated Square account have since been disabled.

HeadsUp: Received a parking ticket, but unsure if it's valid?
1⃣Head to our Citation Payment & Inquiry page
2⃣Enter the citation # on the ticket
☑️If it's in our system, then it's legit.
Note: It may take ~24 hours for tickets to register in our system.https://t.co/Mz9YGLhEHX pic.twitter.com/OXhXfPEPk4

— SFMTA (@SFMTA_Muni) May 5, 2023

Journalist Kim Zetter noted that this was not the first occurrence of such a scam, citing a similar incident involving malicious QR codes on parking meters in Texas. In this instance, scammers in San Francisco are distributing counterfeit parking tickets with QR codes that, when scanned, redirect mobile phone users to a fraudulent website for acceptable payment.

Source: Fraudulent QR code scanning in the name of SpaceX(Twitter)

Concluding thoughts

The evolving tactics employed by fraudsters to deceive individuals are increasing daily. The use of fake and deceptive websites shows the lengths to which scammers could go for their malicious purpose.

Hence, it has become essential for individuals to exercise caution and remain vigilant. Stay informed, take proactive measures, and share information to keep these fraudsters away!