LetzSecure has warned that fraudulent stickers bearing the words ‘Scan and pay’ have been affixed to several parking meters in Luxembourg City. Photo: Shutterstock/LetzSecure

LetzSecure has warned that fraudulent stickers bearing the words ‘Scan and pay’ have been affixed to several parking meters in Luxembourg City.  Photo: Shutterstock/LetzSecure

The LetzSecure team has identified an active “quishing” campaign (QR code phishing) targeting users of paid parking facilities in Luxembourg City. Those at Glacis have already been removed, but fraudulent stickers remain in place.

LetzSecure has warned that fraudulent stickers bearing the words ‘Scan and pay’ have been affixed to several parking meters in Luxembourg City. By scanning the QR code, users are redirected to the website directingtoapps.com, which displays a fake payment service called “ParkPay”. This type of “quishing” (QR code phishing) is not new and is not limited to parking meters.

“The site replicates the entire payment process: entering the number plate, selecting the parking duration, followed by a credit card form, in order to collect victims’ card numbers, expiry dates and CVV codes in real time. This service has no connection with the official Indigo Neo app used by the City of Luxembourg,” the platform explains. On Monday 27 April, LetzSecure noted the presence of these stickers on several parking meters. By the end of the day, those at Glacis had been removed, but fraudulent stickers remain in place at the following locations: Avenue de la Faïencerie, Rue Jean l’Aveugle, Rue Alfred de Musset and Boulevard Joseph II.

Related articles

Banks never contact their customers via text message or email. If you’re unsure, don’t click on anything and report the attempt to your bank or the authorities. You should also contact your bank via its secure app. (Photo: Shutterstock)
POLITICS

Phishing is on the rise, with losses exceeding €10m

Thierry Labro • 15.04.2026
The Court of Justice of the European Union is weighing whether banks can delay refunds after unauthorised payments by arguing customers were grossly negligent. Photo: Shutterstock
BANKS

Banks must refund phishing victims first, recover later

Kangkan Halder • 05.03.2026
240 red USB sticks, “lost” throughout the country, have all too often been used without taking any precautions. Ten years of awareness-raising have done nothing to change this, says Clusil. (Photo: Shutterstock)
ECONOMY

The red USB key, the little weakness that will lose you

Thierry Labro • 10.12.2025