The FBI is warning that criminals are targeting prominent people and their contacts with "OAuth consent phishing" — a technique that survives a password change entirely — while the FTC is separately warning that scammers are pasting fake QR codes directly over real ones on parking meters.

An FBI IC3 public service announcement (I-090126-PSA, September 1, 2026) warns that, since late 2025, criminals have been directly messaging prominent individuals, their family members, and personal acquaintances on commercial messaging apps, impersonating government officials, media, and other public figures to push a malicious link. The link leads to a real "OAuth" permission request for a hostile third-party app — and because the victim grants access rather than typing a password, changing the password afterward does not remove the attacker's access. The FBI advises granting app permissions only to trusted applications and treating messages from unknown senders, even ones with a familiar name attached, with skepticism.

A Federal Trade Commission consumer alert (September 3, 2026) warns that people have reported scammers physically covering a legitimate QR code on a parking meter with a fake one of their own. Scanning it can lead to a lookalike payment site built to steal money or personal information. The FTC's advice: check the link a QR reader previews before tapping it, keep your phone's software updated, and use the parking authority's own app or website instead of a code you find pasted somewhere in public.