Parking QR Code Scams in India: How to Spot Fake Codes and Stay Safe

India's UPI revolution made paying for parking frictionless — scan, pay, go. But it also created a new attack surface. Fraudsters are exploiting the universal trust in QR codes to redirect parking payments into their own accounts. Here's what's happening and how to protect yourself.

1. What Happened: The Viral MCD Parking QR Code Incident

In November 2025, a video went viral on social media showing a parking attendant at a Municipal Corporation of Delhi (MCD) managed parking lot. The lot used Razorpay payment terminals — a legitimate payment processor used by many city parking operators. The attendant had taped a personal PhonePe QR code over the official Razorpay payment device.

Motorists scanning what they believed was the official lot payment QR were actually sending money directly into the attendant's personal UPI-linked account. The official Razorpay system recorded zero transactions while the fraud ran undetected for days.

Razorpay's co-founder acknowledged the incident publicly and announced the company was rolling out tamper-evident physical seals and device-level monitoring to detect QR substitution attempts. The MCD launched an audit of parking lot payment infrastructure across Delhi.

2. How Parking QR Code Scams Work

Three main variants are documented in India:

• Attendant Substitution: A parking attendant places their personal UPI QR over the official payment device. Works in lots where the operator does not physically supervise every transaction. The attendant keeps the cash equivalent of each digital payment.
• Sticker-Over-Sticker: A fraudster visits the parking lot before opening hours and sticks a fake QR code printed on high-quality paper over the official QR on signage boards or payment kiosks. Victims scan what appears to be the official code.
• Phishing QR Boards: In some markets and roadside parking spots, fraudsters erect unofficial-looking "pay here" boards with QR codes that link to UPI collection pages named to look like the official operator (e.g., "MCDparking@xyz" instead of the verified official ID).

3. 5 Ways to Spot a Fake Parking QR Code

1. Check the URL before completing payment: When you scan a QR, your phone shows a preview URL before you proceed. A legitimate parking operator uses their own domain or a known payment gateway. A random URL shortener, a free hosting domain, or anything you don't recognise is a red flag.
2. Verify the payee name on your UPI app: Before confirming payment, your UPI app (PhonePe, GPay, Paytm) shows the payee's registered name. It should match the parking operator. If it shows an individual's name (e.g., "Ramesh Kumar") instead of the company name, stop — this is almost certainly fraud.
3. Look for physical tampering: Examine the QR code for signs of a sticker placed over another sticker — raised edges, bubbles, misaligned borders, or a QR that looks newer than the surrounding signage. Genuine payment terminals are sealed by the operator.
4. Ask for a receipt: After paying, ask for a digital or printed receipt. A legitimate parking system generates a transaction confirmation. If the attendant cannot produce one, demand it — or consider the payment suspect.
5. Pay cash when in doubt: Parking lots always accept cash. If anything feels off about the QR code, pay cash and report the suspicious QR to the lot manager or MCD/BBMP/municipal authority.

4. Vehicle Contact QR Stickers Are Not Payment QR Codes

This distinction is important. Vehicle contact QR stickers like VahanTag are fundamentally different from parking payment QR codes:

• Opens a web form, not a payment screen: Scanning a VahanTag QR takes you to a contact form on vahantag.me — you can send the vehicle owner a WhatsApp message or SMS.
• No UPI, no bank data, no wallet: There is no payment prompt of any kind on the VahanTag scan page.
• Zero financial risk: Even if a malicious actor somehow duplicated a VahanTag sticker, the scanner would only see a contact form — there is nothing to steal.
• No personal data exposed: The scanner does not see the owner's phone number, bank details, or any financial information.

The confusion arises because both types of QR codes appear on or near vehicles in parking contexts. The rule is simple: if a QR code asks you for payment or takes you to a UPI screen, treat it with suspicion. If it opens a contact or information page, it is not a financial risk.

5. How to Report a Parking QR Code Scam

• File a dispute on your UPI app: Go to transaction history, find the payment, and select "Raise Dispute" or "Report Fraud." Act within 24 hours for the best chance of recovery.
• Call 1930: India's national cyber fraud helpline. Available 24/7. They can initiate a hold on the fraudulent UPI ID quickly.
• File at cybercrime.gov.in: Submit a detailed complaint with the transaction ID, payee UPI ID, screenshot of the QR, and the parking lot location.
• Inform the parking lot authority: Contact the municipal corporation or parking operator so they can inspect and replace the compromised QR. This prevents others from falling victim.

6. What Cities and Operators Should Do

• Tamper-evident holograms: Payment QR codes on signage should be protected by holographic overlays that visibly distort or void if removed.
• Embedded QRs: QR codes should be printed directly on payment terminals or metal boards — not on paper stickers that can be covered.
• POS device locks: Handheld payment terminals should require attendant login before displaying payment QR — preventing substitution.
• SMS receipts: Every parking payment should trigger an SMS to the payer's registered number, confirming the operator name and amount.