You pull into a spot, see a QR code on the meter, and scan it to pay for parking. Thirty seconds later, your card number belongs to someone else.

On September 3 the FTC warned that scammers are sticking their own QR codes on parking meters. Scan one and it opens a fake payment page dressed up to look like the city's, built to grab your money, your personal information, or both. Your phone gives you one chance to catch it: the little link preview that appears when your camera reads the code. Scammers count on you not reading it, so look for misspellings or swapped letters before you tap.

The rule: Preview the link before you tap, and if anything looks off, pay at the meter or open your city's official parking app yourself. Already scanned one? Change any passwords you entered, watch your card statement, and report it at ReportFraud.ftc.gov.

Source: FTC: See a QR code parked somewhere? Don't scan it...yet!

You finally find the exact car you have been hunting, priced to sell, at a dealership with wall-to-wall five-star reviews. The whole lot is fake.

On September 1 the FTC warned that scammers are using AI to copy real dealership websites, logos, photos, and inventory included, then baiting them with rare, hard-to-find cars and glowing fake reviews. The giveaway comes at checkout: they want a wire transfer, up front, for a car you have never seen. And they will always have a reason you can't visit the lot or send an independent inspector.

The rule: Search the dealer's name plus "scam" or "complaint" before you pay a cent. Insist on seeing the car in person or hiring a mobile inspection service, and walk away from anyone who only takes wire transfers. Report fakes at ReportFraud.ftc.gov.

Source: FTC: Scammers are spoofing car dealership websites

Ever wonder how a fake tech support line actually charges your credit card? Someone has to run the cash register. This week, the register keeper got the bill.

On September 4 the FTC announced that Nuvei, a payment processor, will pay $4.85 million over charges that it knowingly moved more than $30 million in payments for scammers, including an offshore tech support operation and a company posing as a government tax service. Nuvei is now banned from processing payments for tech support telemarketers at all. The lesson for the rest of us: those scam charges ran through the same card networks as your groceries, which means they can be disputed.

The rule: If you paid a pop-up or cold-call "tech support" service, call your card company and dispute the charge, then have your computer checked by a shop you chose yourself.

Source: FTC: Payment Processor Nuvei to Pay $4.85 Million to Settle Charges It Facilitated Merchant Fraud

The message looks like it is from a journalist, an event planner, or even a government official. The login page it opens is Microsoft's or Google's real one. That is exactly what makes this scam work.

On September 1 the FBI warned about consent phishing. Instead of stealing your password, the scammer builds an app and gets you to approve it. You sign in on the genuine login page, then a permission box asks to let the app read your email and files. Click Allow and the scammer is inside. Here is the nasty part: changing your password does not kick them out. Only removing the app in your security settings does.

The rule: Treat any unexpected permission or "approve access" screen as a stop sign. This week, open your Google or Microsoft account security page and remove any connected app you don't recognize.

Source: FBI IC3: Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing