You've just backed into your slip after a full day on the water. The dock is quiet, there's a QR code on the payment kiosk at the head of the pier, and a sign says to scan and pay for your night's stay. You're sunburned, carrying gear, and not particularly interested in reading the fine print.
That moment — tired, hands full, focused on the next task — is exactly when QR code scammers expect you to scan without checking.
Marinas, boat rental operations, and waterfront recreation hubs have embraced QR codes for everything from slip fees and rental deposits to harbor authority notices and watercraft registration. The problem is the same one that creates risk at campgrounds and EV chargers: unattended outdoor terminals, a trusting environment, and guests who are there to relax, not to scrutinize URLs. Add a high-income demographic and high transaction amounts, and marinas become a particularly attractive target.
Here are the four scam variants operating at marinas and boat rentals right now.
Variant 1: Dock slip payment QR codes
This is the highest-dollar variant and the one most likely to go undetected until your card statement arrives.
Marina slip fees are often paid via self-service kiosks at the pier entrance or at the harbormaster's office — and many marinas have added QR codes to these terminals as an alternative to inserting a card. An attacker places a sticker QR code directly over the legitimate code on the payment terminal. The sticker is cut to fit cleanly, and the fake page it leads to mimics the marina's payment interface: the marina name, a slip fee total, and a card-entry form.
Because slip fees are real, expected, and transactional — boaters are used to paying them quickly and moving on — victims rarely pause to verify the URL. The real marina receives nothing. Victims sometimes discover the fraud only when a dockmast finds no payment record in the system and requests payment again.
The tell: Legitimate marina payment systems use the marina's own domain or a named payment processor such as Dockwa, Marinas.com, or a major card processor with a recognizable URL. If the page you land on has a domain you don't recognize, or one with extra hyphens or words, do not enter card details. Pay at the harbormaster's office in person or by calling the marina directly.
Variant 2: Boat and watercraft rental deposit QR codes
Boat, kayak, jet-ski, and paddleboard rental operations collect deposits at checkout — and QR codes on rental desks, kiosks, and printed rental agreements have become common for this purpose.
Scammers target temporary or pop-up rental operations at high-traffic waterfront locations: beach towns, lake resorts, and tourist marina strips where seasonal businesses change from year to year and visitors don't know what "normal" looks like. A fake QR code on a rental desk sign or printed on an agreement form leads to a payment page that collects the deposit — but routes it to the scammer rather than the rental company. The victim walks away expecting a boat that was never actually reserved.
A second variant targets legitimate rental operators: a printed sticker is placed over the real QR code on a payment kiosk or sign-in tablet, so that real customers of a real business end up paying a scammer instead.
The tell: Before paying any rental deposit via QR code, verify the URL matches the rental company's official website or a named payment processor. If the rental desk is unstaffed or you're using a standalone kiosk, compare the URL to what's printed on the company's business card or official signage. When in doubt, pay in person at the counter.
Variant 3: Fake "harbor patrol" or harbormaster fine QR codes
This variant borrows the authority-and-urgency playbook used by speeding ticket scams and toll road scams, adapted for the waterfront.
A notice appears on a boat's windshield, at a slip post, or in the marina's notice area: the vessel has been cited for an anchoring violation, a registration issue, or an unpaid fee, and payment is due immediately to avoid further penalties. A QR code is provided to pay the fine online.
Legitimate harbormasters and marine law enforcement agencies do not issue fines via QR codes left on boats or slips. Any notice demanding immediate QR-code payment of a maritime fine should be verified by calling the harbormaster directly — using a number obtained from the marina's official website or the posted harbormaster contact information, not from the notice itself.
The tell: A fine notice that includes a QR code and demands immediate payment without a physical citation number you can verify with the issuing agency is almost certainly fraudulent. Contact the harbormaster's office in person or by phone to confirm whether any violation has been recorded.
Variant 4: Jet-ski, kayak, and equipment rental kiosk codes
Smaller watercraft rental kiosks — jet-ski rental stations, kayak launch counters, and stand-up paddleboard concessions — often operate with minimal staffing and rely on QR codes for waivers, payment, and equipment release. These are the easiest to target: a single printed sticker, placed by anyone walking past, can redirect every subsequent payment to a scammer's account.
This variant is low-dollar per transaction but high-volume at busy waterfront destinations. At a popular beach or lake resort, a tampered kayak rental kiosk can process dozens of fraudulent transactions over a summer weekend before anyone notices.
The tell: If a rental kiosk QR code takes you to a page that doesn't match the rental company's name or a recognized payment processor, don't complete the transaction. Rentals costing less than $50 are the transactions victims are least likely to dispute — which is exactly why attackers target them.
What to do if you were scammed at a marina or boat rental
If you entered card details: Call your card issuer immediately. Report the charge as potentially fraudulent and request a new card number. Monitor for small test authorizations ($1–2) that typically precede larger fraudulent charges.
If you paid a rental deposit and no boat was reserved: Contact the rental company directly using a phone number from their official website. If they have no record of your booking or payment, file a dispute with your card issuer and a report with the FTC at ReportFraud.ftc.gov.
If you received a fake harbormaster fine notice: Contact the harbormaster in person and keep the notice — it may be useful for a fraud report with local marine law enforcement.
What to remember on the water
- Marina payment kiosks are unattended and easy to tamper with — the same sticker-QR playbook that works at parking meters and beach parking works equally well at a slip-fee terminal.
- High-income leisure demographics are deliberately targeted because scammers expect less price sensitivity and larger transaction amounts at marinas.
- Summer season brings peak foot traffic and peak scammer activity at waterfront locations.
- Legitimate harbor authorities and rental companies never demand QR-code payment for fines or fees via notices left on your boat or slip.
See also
- What to Do If You Scanned a Suspicious QR Code
- Beach Parking QR Code Scam
- Campground and National Park QR Code Scams
- EV Charger QR Code Scam
- Fake Parking Meter QR Code Scam
Download QRsafer for iOS or Android and scan any marina or boat rental QR code before your browser opens it. It checks the destination against threat intelligence databases in real time and flags phishing pages before you hand over your card details or deposit.