Vance Ingmanson was in San Clemente, California, when he saw a sign with a QR code and a website to pay for parking.
"We punched in the URL. The URL - the first five on the Google search were fakes," he recalled. "It was a scam. It has the logo. It says 'passport parking.'"
Ingmanson was trying to park his car. A few minutes later he knew something was wrong.
RELATED: FBI issues new warning on QR codes: How scammers can steal your data
"I put in my credit card number," he said. "[My wife's] credit card company, about two minutes after I put in my information, called her and said 'We have unauthorized charges here.'"
A similar scam also happened in Redondo Beach. The city says it found fake QR codes stuck to about 150 parking meters along the Esplanade and Riviera Village area. They were glued next to the legitimate ParkMobile and PayByPhone labels.
The fake codes actually sent drivers to a website called "poybyphone" instead of PayByPhone - just one letter off. But that sent users to an entirely different site, asking them to input their location and payment information.
The issue of scammers putting fake QR codes over the real ones could happen anywhere.
"We have heard about QR code scams where people may put a phony sticker over on top of a real QR code, or email someone and tell them to use that code to go to a specific site," Rhonda Perkins of the Federal Trade Commission said. "We definitely want people aware that this type of scam is out there."
RELATED: QR codes in emails? Watch out - it could be part of a 'Quishing' scam
Officials warn thieves can use QR codes to steal important personal information.
"It could be that they send you to a website that's phony, that installs malware on your device, or they're trying to steal your information and make you think that you're on a real website and ask for personal information," Perkins said.
The FTC says if you use a QR code, check the website it sends you to and make sure to look for misspellings or a switched letter.