Fraudulent Payment Stickers Found on City’s Parking Meters

On Tuesday 28 April 2026, LetzSecure reported that it had identified an active "quishing" campaign (QR code phishing) targeting users of paid parking in Luxembourg City.

According to LetzSecure, fraudulent stickers reading "SCANNEZ ET PAYEZ" (Scan and Pay) have been placed on several parking meters across the capital. When scanned, the QR code redirects users to the website “directingtoapps.com”, which displays a fake payment service called "ParkPay". 

LetzSecure detailed that the website replicates a complete payment flow: entering a license plate number, selecting a parking duration, then a credit card form, in order to harvest card numbers, expiry dates and CVV codes from victims in real time.

This service has no connection whatsoever with the official Indigo Neo app used by the City of Luxembourg.

A similar "quishing" campaign was reported by the City of Luxembourg (VdL) in September 2025.

LetzSecure said it had identified the fraudulent stickers on parking meters at Avenue de la Faïencerie, Rue Jean l'Aveugle, Rue Alfred de Musset and Boulevard Joseph II in Luxembourg City. Stickers identified on the Champ du Glacis have since been removed.

LetzSecure confirmed it has contacted the VdL, CIRCL (Computer Incident Response Centre Luxembourg) and the Grand Ducal Police regarding the issue.

Further information can be found at https://letzsecure.com/threats/vdl-parking-quishing-alert-luxembourg-city.