The text message looks official enough. It claims you have an unpaid parking violation or toll charge. There’s a sense of urgency — pay now or face escalating fines. And increasingly, there’s a QR code embedded in the message, designed to shuttle you straight to a convincing but entirely fraudulent payment portal.
Welcome to the latest iteration of smishing — SMS phishing — and it’s working disturbingly well.
According to Mashable, scammers have evolved their traffic violation text schemes by incorporating QR codes, adding a layer of perceived legitimacy that catches even tech-savvy consumers off guard. The messages typically impersonate municipal parking authorities, state toll agencies, or traffic enforcement departments. They reference specific violation numbers, cite plausible fine amounts, and warn of penalties for late payment. The QR code, when scanned, redirects victims to a spoofed government website that harvests credit card numbers, personal identification details, and sometimes even driver’s license information.
This isn’t a fringe problem. It’s a nationwide epidemic.
From Crude Phishing Links to Sophisticated QR Traps
The FBI’s Internet Crime Complaint Center issued warnings about QR code fraud as early as January 2022, noting that cybercriminals were tampering with both digital and physical QR codes to redirect victims to malicious sites. But the fusion of QR codes with traffic violation pretexts represents a sharper, more targeted approach. The scammers aren’t just casting wide nets anymore. They’re crafting messages that align with the daily anxieties of American drivers — the nagging worry that maybe you did forget to feed the meter last Tuesday, or that an E-ZPass charge slipped through.
The Federal Trade Commission has tracked a dramatic surge in text message scams overall. In 2023, consumers reported losing more than $390 million to text-based fraud, according to FTC data — more than double the figure from just two years earlier. Toll and parking scams now represent one of the fastest-growing subcategories.
Multiple state attorneys general have issued alerts in recent months. The Pennsylvania Turnpike Commission, the Massachusetts Department of Transportation, and agencies in Texas, Florida, and California have all publicly warned residents about fraudulent toll messages. None of these agencies collect payments via text message or QR code. Not one.
The mechanics are straightforward but effective. A victim receives a text claiming an outstanding violation. The message includes a QR code or a shortened URL. Scanning the code opens a browser page that mimics a government payment portal — complete with official-looking logos, .gov-adjacent domain names, and form fields requesting full name, address, vehicle registration, and payment card details. Some versions even ask for Social Security numbers under the guise of “identity verification.” The entire interaction can take less than 90 seconds. That’s all the time a scammer needs.
And here’s what makes QR codes particularly dangerous in this context: unlike a suspicious URL that a careful reader might inspect before clicking, a QR code obscures the destination entirely. You can’t see where it leads until you’ve already scanned it. By then, many people are already on the fake site, credit card in hand.
Security researchers at Palo Alto Networks’ Unit 42 have documented a significant increase in QR code phishing campaigns — sometimes called “quishing” — across multiple sectors, including government impersonation. Their analysis found that QR-code-based attacks bypass many traditional email and SMS security filters because the malicious URL is encoded within the image rather than appearing as scannable text. Standard spam detection tools often miss them entirely.
Why These Scams Hit Harder Than You’d Expect
The psychological architecture of these scams is precise. They exploit authority bias — the instinct to comply with what appears to be a government directive. They create time pressure through threatened penalties. And they leverage a universal experience: virtually every American driver has, at some point, wondered whether they properly paid for parking or whether a toll transponder registered correctly.
Dr. Robert Cialdini’s foundational research on persuasion principles maps almost perfectly onto these schemes. Authority. Scarcity. Urgency. The scammers have read the playbook, even if they haven’t read the book.
But the financial damage extends beyond the initial fraudulent charge. Victims who enter their credit card information often find multiple unauthorized transactions within hours. Those who provide driver’s license numbers or Social Security digits face longer-term identity theft risks. Some victims have reported fraudulent tax filings, new credit accounts opened in their names, and compromised bank accounts — all traced back to a single scanned QR code from a text message about an $8.50 parking ticket.
The scale is staggering. The FBI’s IC3 received over 60,000 reports related to phishing and smishing in the first half of 2024 alone. Law enforcement officials acknowledge that actual incident numbers are likely many times higher, since most victims either don’t realize they’ve been scammed or don’t bother reporting it.
Local police departments are struggling to keep up. In many jurisdictions, individual losses fall below the threshold that triggers a dedicated investigation. A $35 fake parking fine doesn’t generate the same law enforcement response as a $35,000 wire fraud — even though the same criminal infrastructure often powers both.
So the scammers operate with near impunity.
The technical infrastructure behind these operations is increasingly sophisticated. Many campaigns use domain names registered through privacy-shielded registrars in countries with limited cooperation agreements with U.S. law enforcement. The phishing pages themselves are often hosted on compromised legitimate websites or on cloud infrastructure that can be spun up and torn down within hours. Some operations rotate through dozens of domains per day, making takedown efforts feel like a game of whack-a-mole.
Telecom carriers have implemented STIR/SHAKEN protocols to authenticate caller IDs and reduce spoofed calls, but the technology is less effective against SMS-based attacks. Text messages can be sent through internet-based gateways that mask the sender’s true identity, and international routing makes tracing difficult. The carriers filter billions of spam texts annually — T-Mobile, AT&T, and Verizon have all touted their blocking numbers — but enough get through to sustain a profitable criminal enterprise.
What should consumers actually do? The guidance from the FTC, FBI, and virtually every state attorney general is consistent: never pay a fine or fee through a link or QR code received via text message. If you think you might genuinely owe a toll or parking violation, go directly to the official agency website by typing the address into your browser. Call the number listed on the agency’s actual website. Don’t use any contact information provided in the suspicious message itself.
Delete the text. Report it by forwarding it to 7726 (SPAM), the reporting number maintained by the cellular industry. File a complaint with the FTC at ReportFraud.ftc.gov. And if you’ve already scanned a code and entered information, contact your bank or card issuer immediately, place a fraud alert on your credit reports, and monitor your accounts closely for unauthorized activity.
The Bigger Picture: QR Codes as an Attack Vector Aren’t Going Away
The parking ticket scam is just one application of a broader trend. QR codes have become ubiquitous — restaurant menus, event tickets, payment apps, product packaging. That ubiquity breeds trust. And trust, in the security world, is a vulnerability.
Researchers at HP Wolf Security noted in a 2024 threat report that QR code attacks increased by more than 500% compared to the prior year. The attacks span corporate environments (fake multi-factor authentication prompts sent to employees), consumer fraud (bogus shipping notifications), and government impersonation (the toll and parking schemes). The common thread is that QR codes create a gap between what you see and where you go — and attackers are exploiting that gap aggressively.
Some cybersecurity firms are developing QR code scanning tools that preview the destination URL before opening it, similar to how link-preview features work in some messaging apps. Google’s Chrome browser on Android now shows the URL embedded in a QR code before navigating to it. Apple’s iOS camera app displays the URL as well, though the text is small and easily overlooked. These are steps in the right direction. They’re not enough.
The fundamental challenge is behavioral. People have been trained — by restaurants, airlines, retailers, and yes, government agencies — to scan QR codes quickly and without much thought. Reversing that conditioning requires sustained public education, and public education campaigns on cybersecurity have historically struggled to gain traction until after a major, headline-grabbing breach.
Meanwhile, the scammers iterate. They test new messages, refine their fake websites, and expand to new geographic targets. Recent reports on X and across local news outlets describe waves of toll scam texts hitting residents in Illinois, New Jersey, and Virginia in June and July 2025. The messages reference specific toll roads and bridges by name, adding another layer of false credibility.
For now, the best defense remains skepticism. That text about your unpaid parking ticket? Almost certainly fake. The QR code promising a quick resolution? A trap. The sense of urgency pushing you to act before thinking? Manufactured.
Don’t scan it. Don’t click it. And don’t pay it.
WebProNews is an iEntry Publication