Beware at the parking meter: Fake QR stickers in Palma's port deceive drivers

Beware at the parking meter: fake QR stickers in Palma's port

Yesterday afternoon, between the calls of the seagulls and the steady drone of a ferry, I paused briefly at the port and thought: another parking ticket to buy. Then I noticed a small, shiny sticker on the machine — almost too professional to be fake. But it is. Unknown people are sticking forged QR stickers that read “Escanea y Paga” onto machines. Anyone who pays via these links is taken to a fake payment page and hands over card or account details directly to criminals.

What is known so far

The first cases were discovered in the port area of Palma (Mallorca Magic report on fake QR codes at Palma harbour), especially in places with high visitor numbers. The port police have started removing the stickers, and investigations are ongoing. There is a central hotline for reports and tips: 971 228 487. Whether municipal parking meters are also affected is being checked by the city administration. For now we know: the scam is simple and effective — because many people are in a hurry or the stickers look deceptively real. More local coverage is available in Estafa en Palma: códigos QR falsos en parquímetros.

How to spot the trap

A few moments of attention often save a lot of trouble. Pay attention to these points: does the sticker look like it was applied later or does it sit cleanly as part of the print? Do the edges look makeshift, is tape or air bubbles visible? When scanning, check the address in the address bar: does the domain belong to an official port or city site or is it a short, unfamiliar URL with typos? For practical tips on recognising phishing pages see the Oficina de Seguridad del Internauta guidance on spotting phishing.

Important to know: an HTTPS lock symbol alone is not a free pass — many phishing sites now use encrypted connections. If the page suddenly asks for full bank details, CVV/CVC or entries that a normal parking process would not require, better stop. If possible: pay in cash or use the official app.

If you are affected

If you have already entered data, do not hesitate: call your bank immediately and have the card blocked. Every minute counts. Take photos of the machine and the sticker, note the exact location and report the incident to the Spanish National Police and the port police using the number above. Monitor your account activity closely in the following hours and dispute any unknown charges immediately.

Why this keeps working — and what we should do about it

The perpetrators rely on speed and routine. Around 9 a.m. and 7 p.m., holidaymakers and commuters often crowd the machines, eager to pay quickly before the ferry departs or dinner waits. Small, cheap stickers are inexpensive to produce and easy to distribute. They only need a short-term success to harvest profitable data.

The authorities react: remove, check, warn, including the Port Authority of the Balearic Islands. But that alone is not enough. Concrete improvements would help — for example tamper-proof QR stickers integrated into the housing or protected under glass, regular visual checks by port and city staff, clearly visible signs reading "Use only official QR codes" and a multilingual information campaign. Technically, contactless payment terminals with NFC could also be considered to minimise the risk of fake web forms.

Practical tips on the go

Short and clear: think briefly before you scan. Photograph suspicious stickers, call the hotline 971 228 487, pay in cash or via the official app if in doubt, and never enter full card or account details on an unknown site. Check your card transactions and report irregularities immediately.

The moral of the story is simple: a suspicious look at the machine costs ten seconds but saves hours of trouble. In Palma, where the sea roars and taxis wait for customers on the Passeig Marítim, it's often the small things that ruin or save the day. So: be alert — the stickers are small, the consequences can be big.