Fake parking tickets carry city logo and correct number plate
Unknown perpetrators attached fake parking tickets to parked cars in the German town of Villingen-Schwenningen in July 2026, police said. According to police, the notes closely resemble genuine city warnings. They bear the city logo and are filled in with the correct number plate, street, date and time.
The printed QR code leads to a fraudulent website demanding payment of an alleged parking fee, according to police. Payments go directly to the perpetrators, police said. Officers advised those affected not to scan the code, not to pay and to file a report.
Genuine warnings from German cities do not normally contain a QR code for instant payment. Payment is made by bank transfer to a city treasury account, not via a website linked by QR code.
How to recognise fake parking tickets
QR code for payment
Genuine warnings never ask for payment via QR code. This is the clearest warning sign.
Missing case number
Official warnings contain a case number that you can verify with the city.
Check the payee
Payments always go to the city treasury with a German IBAN – not to private accounts or foreign payment services.
When in doubt: call the city
A call to the public order office clarifies within two minutes whether the warning is genuine.
Perpetrators fill in each ticket individually
According to police, the perpetrators filled in each ticket individually – on site, with number plate, street and time. That makes the forgeries difficult to distinguish from genuine warnings, police said. Similar cases had previously been reported in Berlin-Marzahn.
Scan QR codes safely with QRTrust
QRTrust checks every QR code in real time against multiple phishing databases and AI models before you open the website.
You can find all documented incidents – including this one – on our interactive quishing map.
View the quishing map →About QRTrust
QRTrust is Germany's first QR code security platform, developed in Dortmund. AI-powered real-time detection, a local threat database and multi-layered security checks protect citizens, authorities and businesses from quishing attacks. GDPR compliant, hosted in Germany.