A “final notice” in the mailbox, and a QR code that wasn’t

A printed letter about an unpaid parking fine sent a small-business owner to a fake payment site. A sticker on the code gave it away.

What happened

Dana, 45, found an envelope from the “City Parking Enforcement Division” in her mailbox. Inside was a final notice: a $95 fine for parking in a loading zone, rising to $250 if not paid within 7 days. To pay, scan the QR code.

She had parked downtown that month, so it seemed possible. She was about to scan the code when she noticed it was printed on a slightly raised sticker, stuck over the page.

“A letter feels official. That’s exactly why it worked on everyone else on my street.”

The scam

Scammers are now sending fake letters by mail because people trust paper more than texts. A QR code hides the web address, so you can’t see where it goes until you’re already on the page. This is sometimes called “quishing”.

The fake site looked like the city’s payment portal and asked for card details, a home address and date of birth, which is enough to open new accounts in her name.

What Dana did

Dana didn’t scan it. She looked up the city’s parking department herself, searched for the citation number on the official site, and found nothing. She called, and they confirmed there was no fine, and asked her to bring the letter in.

Red flags

• A QR code on a sticker, or one that looks added on.
• A fine you don’t recognise, with a short deadline and a big penalty.
• No citation number you can look up on the official site.
• A payment page that asks for your date of birth or Social Security number.

How to protect yourself

• Don’t pay a fine from a QR code or link. Go to the agency’s site by typing the address, and look up the citation number there.
• Before scanning any QR code, check where it goes. Most phones show the address first.
• If a letter looks official but feels off, call the agency on a number you found yourself.
• You can photograph any letter and ask Percy to check it.

Every story is a composite of commonly reported cases. Names, places, amounts and links are changed.