Montreal’s parking agency warns of fake QR codes after fraud report

Montreal’s parking agency is urging caution after a fraudulent QR code appeared on a city parking sign, prompting concerns over rising QR-based scams.

Montreal’s parking agency is warning people to watch out for fraudulent QR codes after someone reported being scammed through a code they scanned on one of the city’s parking signs.

The Agence de mobilité durable de Montréal said the QR code was reported as being placed on a sign promoting its new parking app: Mobicité.

“Our signs never included QR codes,” said Caroline Labelle, spokesperson with the agency. “We immediately asked our teams in the field to stay alert and remove any sign that includes a QR code.”

Labelle added that no tampered signs have been found so far, but a preventative alert was posted on the agency’s social media channels.

The agency said it does not use QR codes for any part of the Mobicité app download process.

The fake QR code prompted broader concerns about the safety of scanning unfamiliar codes, something that’s becoming increasingly common in restaurants and various advertising.

“Nowadays we have QR codes to scan everywhere,” said Montrealer Théo Hug. “Sometimes you don’t even have the option of paper menus or information on paper anymore. It just opens the door to more scams.”

His friend, Owen Abbadou, said he had already seen a friend get scammed through a QR code that appeared to be for a travel agency.

“These things are becoming more common,” he said. “We should all get in the habit of double-checking before we scan anything, make sure it’s from a known, trusted source.”

Technology analyst Carmi Levy said QR codes offer both usefulness and risk.

“It’s incredibly convenient to just point your phone at a code and let it take you to a website,” he said. “But it’s also incredibly risky when someone can just print a sticker with a malicious code and place it over a legitimate one — or like in this case, put a code where one never existed to begin with.”

Those speedy QR codes, he said, can easily allow scammers to trick people into handing over sensitive information.

“In some cases, you’re redirected to a rogue site that steals your authentication info, your usernames and passwords, and that’s all it takes to access your accounts,” Levy explained. “We expect phishing attempts in our inboxes or text messages.”

“We don’t assume that we’re going to be targeted when we’re just walking down the street, pointing our phone at a parking sign.” - Carmi Levy, technology analyst

He stressed that cybersecurity is a shared responsibility.

“City officials, app developers, and regular users, we all have a role to play,” he said. “If something looks off, don’t scan it. And if you think the code doesn’t belong, report it.”

Some Montrealers said they’re already cautious, but admitted it’s getting harder to spot scams.

Angelica Tayag said she’s especially wary of how easy it is to be tricked.

“It’s just super easy nowadays for these scams to happen,” she said. “With just one click, you can lose all your information.”

Alexandra Ségur agreed, saying the rise of QR-based fraud makes her nervous.

“It’s scary, especially if you’re not paying close attention,” she said. “That’s why I’m trying to stay more and more vigilant.”

Driver Pascal Nadon said the threat is real and effective.

“If you’re not paying attention, it’s easier than ever to fall into the trap,” he said. “These scams work. That’s the problem.”

The parking agency’s Mobicité app is available for download on the Apple App Store and Google Play. The previous app, P$ Service Mobile, will be retired after July 28.

Mobicité officially launched on June 20. The Agence de mobilité durable told CTV News it cost $719,000 to develop and launch. A web version of the platform will also be available starting July 28, or drivers can continue to pay at parking terminals.

The agency is urging anyone who sees a suspicious QR code on a parking sign, especially those referencing Mobicité, to report it to their customer service line. Anyone affected by a scam is also encouraged to file a police report.