If you got a sketchy text last year about an unpaid toll or parking ticket, you weren’t alone. Those DMV and E-ZPass phishing scams swept across the country in 2025, targeting drivers in states like California, Florida, and New York with fraudulent messages designed to scare people into handing over their personal and financial information. Now the scammers are back, and they’ve upgraded their approach.
In the latest iteration of this scam, consumers receive a text message warning them they are receiving a “final notice” for a traffic violation, warning them to make an urgent payment, and pointing them to a QR code for payment.
According to a new report from BleepingComputer, a wave of these traffic violation phishing texts is making the rounds across at least nine states: California, Connecticut, Illinois, New Jersey, North Carolina, Virginia, and Texas. Mashable also found evidence that scammers are targeting people in Georgia as well.
This time, instead of a simple link, the messages include an image of a fake official court notice and a QR code. The notice is dressed up in convincing legal language, warning recipients that their vehicle is the subject of an outstanding violation and that the matter has entered “formal enforcement stage.” Scan the QR code, it instructs, to settle your unpaid balance.
‘Castfishing’ is the latest scam, and it’s scary like sextortion
That balance, in every case that BleepingComputer documented, is $6.99 — a small enough amount that plenty of people won’t think twice about paying it.
Scanning the code takes victims through a CAPTCHA before depositing them on a fake DMV site designed to harvest names, addresses, phone numbers, and credit card information. The stolen data can then be used for identity theft, financial fraud, or sold to other bad actors.
Mashable Light Speed
The previous version of the scam, which we covered last year, relied on clickable links that security software could more easily flag. The embedded images on top of the added CAPTCHA make it harder for automated systems and security researchers to catch.
The Illinois Department of Transportation issued an alert this past March warning residents that texts claiming recipients owe money for traffic tickets, tolls, or other fines are not legitimate messages from the state. That warning echoes what DMV agencies in New York and elsewhere have said repeatedly: state agencies do not use text messages to collect payments or request personal information.
Most recently, California Attorney General Rob Bonta issued a press release warning Californians about the scam.
This Tweet is currently unavailable. It might be loading or has been removed.
This Tweet is currently unavailable. It might be loading or has been removed.
What to do if you receive a traffic violation notice by text
The rule here hasn’t changed, even if the scam has. If you get an unsolicited text about an unpaid fine, traffic violation, or court case, regardless of how official it looks, don’t scan anything, don’t click anything, and don’t pay anything.
Contact your local traffic court or state DMV for information about any outstanding violations or fines, which will typically arrive by mail.
Finally, you can report suspected phishing scams to the FTC or the FBI’s Internet Crime Complaint Center. You can ignore the text message or delete it.
Have a story to share about a scam or security breach that impacted you? Tell us about it. Email (email protected) with the subject line “Safety Net” or use this form. Someone from Mashable will get in touch.
Topics
Cybersecurity Scams
