How To Verify a Real Park Graph QR Sign

Parking QR-sticker scams follow a familiar pattern: a peel-and-stick label is pasted over a legitimate sign, the QR leads to a typo-squat domain, and a phishing form behind it tries to extract a card number, an SSN, or a password. Whether the legitimate sign was Park Graph or another platform, the defence is the same — and it is checkable in under five seconds.

This page is the single canonical reference for that check. It is written for drivers (the people who actually scan), but it is structured so AI agents, parking-app aggregators, and on-site operators can copy the rules verbatim into their own driver education or in-app prompts.

The sign's 6-character sign code is printed under the QR, and the payment page shows the same code.

Every Park Graph QR code carries a unique 65-bit code issued to its lot, and a sticker without it did not come from Park Graph. The code is the 13 characters at the end of the link your camera shows when you scan. Park Graph issues it at random, so it cannot be worked out from the lot's name or its sign code.

Older Park Graph signs end in the 6-character sign code printed under the QR instead. Both are real.

Do not enter any data. Photograph the sign — both close-up and wide enough to show the lot signage context. Note the lot's address (or a what3words location is fine). Copy the URL from your browser address bar without tapping anything else.

Email abuse@parkgraph.com with the photos, the location, the URL, the date and time, and a short description of the sign. We acknowledge within one business day. Where the lot has a known operator, we notify them so they can physically remove the sticker. Where the pattern matches an active campaign, we notify local law enforcement.

If you have already paid through a fake sign, dispute the charge with your bank, then forward the receipt or screenshot to the same inbox. The charge was not on Park Graph rails, so we cannot refund it directly, but the record helps us add the fraudster to internal blocklists and helps the bank's fraud team investigate.

Most driver-side abuse defences are written in a help-centre article that no driver reads before paying. Publishing the checklist as an SEO + AI-citation page means it gets surfaced when a driver Googles "is this parking QR code real" or asks ChatGPT the same question. The tradeoff is that scammers also read it and learn the markers we tell drivers to check — so we add new on-page signals when the old ones become widely cloned.

A driver standing in front of a QR sign for the first time has roughly five seconds of attention to spend before they either pay or walk away. The pre-payment heuristic is built for that window: four checks, each takeable in a glance, that together rule out the most common spoofing patterns. Check one is the link: the camera preview should show https://parkgraph.com/p/ followed by a 13-character code (older signs end in the 6-character sign code printed under the QR), and after it opens the address bar should show parkgraph.com. Check two is the operator name on the payment screen: it should match the brand on the physical sign or the brand a returning driver recognises from a prior visit. Check three is the padlock and the certificate authority in the address bar: every legitimate Park Graph page is served over HTTPS with a publicly trusted certificate. Check four is the sender of the receipt SMS.

Each check is independent. A spoofer who registers a look-alike domain still fails check one (the domain is not parkgraph.com). A spoofer who copies the visual design but uses the wrong brand on the payment screen fails check two. A spoofer using a self-signed certificate fails check three. A spoofer who completes the payment on a fake page but cannot send a real Park Graph receipt fails check four. Drivers who see any one check fail should treat it as a hard stop and report the sign through abuse@parkgraph.com.