Almost all parking machines in the city centre affected
Unknown perpetrators covered parking ticket machines in the German town of Dorsten with fake QR code stickers, according to the city. Almost all machines in the city centre were affected in mid-June 2026, city officials said. The stickers imitated the design of parking provider EasyPark. Scanning the code led not to the official app but to the phishing site easy-parked.com.
The fake site asked users to enter credit card details for a purported parking fee. The city of Dorsten said it had the stickers removed and announced regular inspections of all machines.
The domain easy-parked.com is not affiliated with the provider EasyPark (easypark.com). Check the URL before every payment – deviations such as hyphens or different endings can indicate a fraudulent site.
How the scheme worked
- The perpetrators covered the genuine QR code on the parking machine with a sticker in EasyPark design.
- The scan led to easy-parked.com – a copy of the genuine payment page.
- There, credit card details were requested for the alleged parking fee.
- The captured data can be used to make payments or be sold on to other criminals.
Recommended precautions
- • Check whether the QR code is a sticker – run your finger over the surface.
- • Use the provider’s official app from the app store instead of QR codes on the machine.
- • Check the URL carefully before entering payment details.
- • Use a scanning app that shows the destination URL before opening it and checks for phishing.
- • Anyone who has already entered their details should block their card immediately and report the incident to the police.
All quishing incidents at a glance
The Dorsten case is one of a series of similar incidents in Germany. The interactive QRTrust quishing map documents known QR code fraud cases in Germany.
View the quishing map →About QRTrust
QRTrust is Germany's first QR code security platform, developed in Dortmund. AI-powered real-time detection, a local threat database and multi-layered security checks protect citizens, authorities and businesses from quishing attacks. GDPR compliant, hosted in Germany.