Fake Traffic Violation Texts Use QR Codes to Steal Payment Data

A smishing campaign is sending fake traffic violation, toll evasion, and DMV-related text messages to drivers across multiple U.S. states and other countries, impersonating courts, motor vehicle agencies, and toll operators such as E-ZPass. The messages pressure recipients with claims of unpaid fines, license suspension, or arrest, often cite small balances such as $6.99, and direct targets to malicious links or QR codes designed to harvest personal and financial information. Reported activity spans New York, California, North Carolina, Illinois, Virginia, Texas, Connecticut, and New Jersey, with similar lures also observed in Canada and India.

Researchers said the campaign increasingly uses embedded QR codes to bypass security filters, sometimes sending victims through a CAPTCHA-protected intermediary page before redirecting them to spoofed payment portals. Observed phishing infrastructure included domains such as ny.gov-skd[.]org and ny.ofkhv[.]life, while the texts often originated from random or international numbers. State agencies said they do not request payment or sensitive information by text message, and recipients are being urged not to click, scan, or reply, to verify any alleged violation through official websites or contact channels, and to report the scam to their mobile carrier, the FTC, and the FBI IC3; anyone who submitted payment data should contact their bank immediately and replace affected cards.