The Wrong QR Code: How a Sticker on a Halifax Harbour Kiosk Redirected Tourists — and Their Payments

HALIFAX, N.S. — October 28, 2026 — The sticker looked official. It was the right size, the right shape, and it sat exactly where a visitor would expect a payment code to be — over the harbour tour kiosk’s own code, on a busy stretch of the Halifax boardwalk.

Tourists who scanned it did not reach the tour operator’s booking page. They reached a convincing copy of it, complete with sailing times, ticket prices, and a checkout form that collected card details and sent nothing back but a fake confirmation.

The scam did not hack the kiosk. It simply covered it up.

Harbourlight Tours, the fictional operator that runs the kiosk, says the sticker was discovered by a staff member during a morning walk-around, after several customers arrived at the dock holding confirmations the company had never issued. The legitimate code underneath was untouched. The fake one on top did all the work.

“We check the kiosks every morning, and that morning we almost missed it,” said Elena Marsh, the company’s fictional operations manager. “It looked like ours. It was only when a customer showed us their confirmation email that we realized the money had gone somewhere else entirely.”

QR code stickers are cheap, fast to print, and almost impossible for a passerby to verify by eye.

Fraud prevention advisors say that is precisely why the tactic keeps spreading — from parking meters to restaurant tables to transit stops. The attacker needs no access to the business’s systems, no malware, and no inside help. A printer, a sticker, and a busy location are enough.

“People trust a code that is already in place,” said one fraud prevention advisor familiar with payment scams. “Nobody stops on a boardwalk to inspect a sticker. They scan, they pay, and they walk to the boat.”

The copied booking page added to the illusion. It mirrored the real site’s layout and prices, and its confirmation emails arrived promptly — so promptly that several victims only learned they had been scammed when they tried to board and their names were not on the list.

Harbourlight Tours says it has since replaced the kiosk codes with tamper-evident panels, added a second check to its morning routine, and posted a notice telling visitors to book only through the staffed window or the address printed on the kiosk itself, not through any loose sticker.

The fix, experts say, is boring — and that is the point. Businesses that rely on public-facing codes should inspect them on a schedule, use codes that cannot be peeled and replaced without leaving evidence, and give customers a second way to verify: a staffed counter, a printed address, or a code displayed behind glass.

For visitors, the advice is simpler still: if a payment code looks stuck on, layered, or slightly off-centre, do not scan it. Step inside, ask a staff member, or type the business’s address yourself.

Harbourlight Tours says affected customers have been offered rebookings, and the company is working with its payment provider to trace the diverted transactions. No estimate of total losses has been released.

The boardwalk is busy again, and the kiosk is back in service. The sticker is gone. But the lesson it left behind is hard to peel off: in a world where paying means pointing a phone at a square, the square itself has become a target.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.