A Brooklyn man pleaded not guilty Tuesday to an 11-count indictment accusing him of plastering fake QR code stickers across dozens of Manhattan parking meters in a scheme to steal drivers' financial information. Mihai Theodor Enescu, 39, was arraigned in New York State Supreme Court and now faces five counts of identity theft and six counts of criminal impersonation tied to the scam.
According to Manhattan District Attorney Alvin Bragg
, the scheme came to light after a driver scanned a QR code sticker on a parking meter near 79 East 10th Street in June 2025. The sticker read “Web Pay. Scan to Pay” and led to a site displaying the official ParkNYC logo, which then asked for a credit card number, expiration date, phone number, billing address, and license plate number. The driver noticed the sticker had been placed directly over the legitimate ParkNYC sticker and alerted his bank before losing any money, allowing him to avoid financial loss.
That tip set off a joint investigation by the Manhattan District Attorney's Office and the city's Department of Investigation. The DOT reported the scam to DOI, then canvassed and inspected every parking meter in Manhattan, ultimately finding and removing 64 fraudulent QR code stickers. DOI used cyber investigative and digital forensic techniques to trace the fraudulent website's account back to Enescu, who investigators say also purchased two packs of 4-by-6-inch shipping labels — the kind of material used to print the fake stickers.
Charges Carry Felony and Misdemeanor Exposure
Enescu is charged with five counts of identity theft in the second degree, a Class E felony under New York Penal Law § 190.79 that can carry up to four years in state prison per count when fraud involves losses exceeding $500. He also faces six counts of criminal impersonation in the second degree, a Class A misdemeanor under New York Penal Law § 190.25 punishable by up to a year in jail per count, which applies to assuming another entity's identity online to defraud victims. Andrew Trueheart is handling the prosecution through the DA's Cyber Crimes Bureau.
“New Yorkers should not have to worry that paying to park their car could end in identity theft,” Bragg said, adding that the city never asks drivers to scan a QR code to pay for parking. DOI Commissioner Nadia I. Shihata said the defendant allegedly used Manhattan parking meters to obtain motorists' financial information, funneling victims toward a fake ParkNYC payment page. The DA's office thanked DOI and DOT for partnering on the investigation, which remains ongoing.
A Scam City Officials Flagged More Than a Year Earlier
The Manhattan meter scheme didn't emerge in isolation. NYC DOT Commissioner Ydanis Rodriguez issued a consumer alert in June 2025 warning drivers that fraudulent QR code stickers were turning up on ParkNYC meters across Manhattan, an advisory triggered after a tourist posted a photo of a tampered meter to Reddit, according to NYC.gov. DOT guidance has long made clear that legitimate meters never display QR codes for payment — drivers are supposed to use the meter's coin or card slot or the official ParkNYC app, per NYC311.
City officials have set up dedicated channels for reporting suspicious stickers, including ParkNYC customer service at 1-800-428-4027 or by emailing [email protected]. Victims of parking scams specifically tied to this case are urged to call the Manhattan DA's fraud line at 212-335-8900. NYC DOT Commissioner Mike Flynn said the agency will continue working with partner agencies to crack down on the behavior.
Part of a Fast-Growing National “Quishing” Problem
QR code phishing, or “quishing,” has exploded well beyond New York's parking meters. Microsoft threat data cited by Forbes showed quishing attack volume spiking 146% globally in the first quarter of 2026, reaching 18.7 million incidents in March alone, a surge analysts attribute partly to the fact that image-based scans can slip past traditional text-based security filters. The FTC and FBI have issued nationwide alerts warning motorists that scammers are placing fake QR codes over parking payment signage to harvest credit card numbers and personal data, with regulators cautioning that law enforcement cannot guarantee recovery of money once it's transferred, according to the FTC.
The tactic has already hit other major cities. In Austin, Texas, police discovered more than 100 parking meters altered with fraudulent QR code stickers in a single incident, and similar cases have surfaced in Houston, San Antonio, and Orlando, according to susQR. Hoodline previously reported on fake QR parking tickets hitting Texas drivers. New York has its own history with the tactic beyond meters — between 2023 and 2025, scammers placed counterfeit QR stickers over legitimate advertising codes inside MTA subway cars to harvest riders' personal data, prompting the MTA to increase station inspections and partner with the NYPD, per susQR's New York-focused reporting.
With the investigation still active, officials have not said whether Enescu acted alone or how many drivers may have entered financial information into the fraudulent site before DOT swept the stickers off Manhattan's meters. The Manhattan DA's office and DOI are continuing to urge New Yorkers to stay vigilant against parking-related scams as the case moves through the courts.
