I have a villain hacking municipal parking meter payment systems to harvest people's credit card data. Is that actually possible?

Let me tell you something about municipal infrastructure security that will simultaneously make your fiction more believable and ruin your ability to sleep at night.

Yes, it's absolutely possible, and in fact it's been done. Not just theoretically possible in the way that writers like to say "could this happen" while hoping I'll say no and make their lives easier. I mean it has happened, it does happen, and in several documented cases it went on for months before anyone noticed. San Francisco, Los Angeles, Chicago — various municipalities have dealt with compromised payment kiosks, and the common thread in almost every case is the same: nobody was watching.

The monitoring question is where your fiction can get genuinely interesting, because the answer is a jurisdictional nightmare that would make a first-year law student cry. The parking meters are typically managed by a city transportation or public works department. The payment processing runs through a third-party vendor. The financial data passes through networks regulated under PCI-DSS — a financial industry standard, not a law enforcement one. So you've got the city, the vendor, the card networks, and potentially the bank, all of whom have some theoretical interest in this data and approximately none of whom are talking to each other in real time.

Now, who investigates this when it finally gets noticed? At the federal level, this is Secret Service territory primarily, because they have jurisdiction over financial crimes and specifically payment card fraud. FBI Cyber Division also has a stake. The local police department finds out about it roughly when the Secret Service shows up and asks to use a conference room, which is both accurate and a genuine source of institutional resentment that your fiction should absolutely exploit.

Here's what I want you to walk away with: the most realistic element you can put in your fiction isn't a genius hacker in a dark room. It's the six-month gap between when the crime happened and when anyone realized it, and the absolute jurisdictional food fight that erupts once they do. Write the detective who finds out about this because a Secret Service agent calls and doesn't say thank you. Write the city IT guy who genuinely didn't know this was possible. That's your story. The hack is almost the boring part — what's interesting is everything that happens in the silence afterward.