QR code scams have evolved into a new and dangerous form of fraud targeting drivers across the United States. Scammers send fake text messages pretending to be from state courts, tricking recipients into scanning a QR code that leads to a phishing and demands a payment of $6.99. In reality, the scammers steal personal and financial information.
This new variation is an evolution of the widespread toll violation and unpaid parking ticket scams that targeted users in 2025.The new campaign started a few weeks ago, with someone sharing a message targeting New York, while many other people reported similar messages for other states: California, North Carolina, Illinois, Virginia, Texas, Connecticut , and New Jersey.
See also: Critical vulnerability in Claude Code comes after code leak
Unlike the previous campaign that included text messages and links to phishing, this new variant includes an image of an alleged court notice with an embedded QR code. The fake court notice states: “This notice is a final and urgent warning regarding an outstanding traffic violation involving your registered vehicle within the State of New York. This matter has now entered the formal enforcement stage.”
How QR code scams work and danger signs
The text message claims to be from the “New York City Criminal Court,” stating that there is an outstanding parking or toll violation that must be paid immediately. Otherwise, the individual must appear in court. Instructions are included to scan a QR code to settle the outstanding balance. Scanning the QR code takes the targeted individual to an intermediary website that asks them to solve a captcha to prove they are human.
QR codes and CAPTCHAs are used to make the phishing campaign more difficult for automated security software to analyze. Solving the CAPTCHA redirects the user to another phishing website that mimics the state DMV or other organization, claiming that there is an outstanding balance. In all examples observed by Bleeping Computer, this outstanding balance is $6.99 .
Phishing websites that mimic the New York DMV use the hostname “ny.gov-skd[.]org” or “ny.ofkhv[.]life”.
By clicking “continue” the user will be taken to a page where they can enter personal details and credit card information to pay the alleged charge. This form is used to steal data, including name, address, phone number, email address and credit card information.
See also: Claude Code discovered zero-day in Vim and GNU Emacs
This information can then be used for a wide variety of malicious activities, including subsequent phishing, financial fraud, identity theft, and selling data to other threat actors. According to BleepingComputer, the campaign has affected multiple states across the US.
The evolution of “Quishing” and fraud techniques
The phenomenon of “quishing” (QR code phishing) has emerged as a distinct type of attack because many people inherently trust QR codes used in everyday contexts such as restaurant menus and event tickets. Unlike traditional phishing that users might examine carefully, QR codes bypass this distrust.
Security experts describe the attack as particularly effective because it forces people to act quickly without verifying the message.
Protection from QR code scams and security tips
As a general rule, if you receive a message from an unknown phone number or email address requesting a bill payment, ignore it. Government agencies have repeatedly stated that they do not use text messages that request personal or payment information.
See also: Claude Code: Code leak via Anthropic's npm packaging bug
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
To protect yourself from QR code scams, experts recommend not scanning codes in unexpected text messages, verifying violations directly by contacting the organization via an official phone number (from government websites). Finally, keep in mind that legitimate government organizations do not demand immediate payment via QR codes or text messages.
Source: www.bleepingcomputer.com
