Cybercriminals are evolving their tactics once again, with a new wave of phishing scams now using QR codes in fake traffic violation text messages. Security researchers warn that these scams, recently spotted across multiple U.S. states, are designed to trick users into handing over sensitive personal and financial information by mimicking official government notices.
The scam typically begins with a text message claiming the recipient has an unpaid traffic violation or “Notice of Default.” Unlike earlier versions that relied on clickable links, these newer messages include an image of an official-looking notice embedded with a QR code. Victims are urged to scan the code to avoid penalties, legal action, or additional fines.
Why you should be careful
Once scanned, the QR code redirects users to a phishing website disguised as a legitimate government portal, such as a Department of Motor Vehicles (DMV) page. These sites often ask for a small payment – commonly around $6.99 – but their real goal is to collect sensitive data, including names, addresses, phone numbers, and credit card details.
This shift to QR codes marks a significant evolution in phishing tactics. Known as “quishing,” QR-based phishing allows attackers to bypass traditional security filters that typically scan URLs in emails or texts. Because QR codes are harder to inspect visually and are widely trusted for everyday tasks like payments and menus, users are more likely to interact with them without suspicion.
For consumers, the implications are serious
These scams exploit urgency and fear – two powerful psychological triggers – by threatening fines or legal consequences. As a result, even cautious users may act quickly without verifying the authenticity of the message. Authorities consistently warn that courts and government agencies do not request payments or sensitive information via unsolicited text messages or QR codes.
The growing use of QR codes in scams also reflects broader digital trends. As QR-based interactions become more common in payments, ticketing, and authentication, they are increasingly being weaponized by cybercriminals. This makes awareness and skepticism more important than ever.
Looking ahead, cybersecurity experts expect these attacks to become more sophisticated, potentially incorporating more realistic branding and targeted messaging. Law enforcement agencies are urging users to avoid scanning unknown QR codes, verify any traffic violations through official government websites, and report suspicious messages immediately.
As phishing tactics continue to evolve, the message is clear: convenience tools like QR codes can also become security risks if used without caution.
