Traffic Violation Text Scam Hits 10 States. Here's Why Scammers Switched to QR Codes

What's Happening Right Now

In April 2026, a fake traffic violation text scam spread to at least 10 US states, prompting the Federal Trade Commission to issue a consumer alert and the New Hampshire Department of Justice to publish a state level advisory. Reports have come in from New York, California, North Carolina, Illinois, Virginia, Texas, Connecticut, New Jersey, New Hampshire, and Ohio.

Unlike previous text scam waves, this campaign does not include a clickable link. Instead, every message contains a QR code that the recipient is told to scan to "settle" a $6.99 fee. ScamVerify™ tracks this as a deliberate evolution by scammers in response to carrier level link filtering, and the data shows it is working.

How the Scam Works

The flow follows a predictable five step pattern:

1. The text arrives. It claims to be a "Notice of Default" from a state court or DMV, citing an unpaid traffic violation. The message warns of court referral, license suspension, or arrest within 24 hours.
2. The QR code replaces the link. The text instructs the recipient to scan a QR code to view their case and pay.
3. A CAPTCHA gate appears. Scanning the code lands the victim on a "prove you are human" page. This step blocks automated security tools and researchers from analyzing the destination.
4. A fake court or DMV portal loads. The page mimics official branding closely enough to pass a quick glance, complete with a fake case number and a payment field.
5. The victim enters their card details. The scam asks for $6.99 plus their full name, address, date of birth, and credit card number. Some variants also request the last four digits of a Social Security number.

The $6.99 is rarely the goal. The real prize is the card number and identity information, which scammers either resell or use for larger fraud against the same victim within hours.

Why Scammers Switched From Links to QR Codes

This is the most important shift in the 2026 text scam landscape, and it explains why this campaign is different from prior years.

US wireless carriers, including Verizon, T-Mobile, and AT&T, now scan SMS and MMS messages for known malicious URLs and either block delivery or flag the message with a warning. According to BleepingComputer, this defense pushed scammers to find a delivery method that bypasses URL inspection entirely.

QR codes solve the scammer's problem in three ways:

• The URL is invisible to carrier filters. A QR code is just a black and white image. Carriers cannot decode and inspect the embedded URL the way they can a plain link.
• The CAPTCHA gate after the scan blocks automated analysis. Security researchers and threat intelligence platforms cannot easily map the destination of the scam, which extends its operational lifetime.
• The user does the work. The victim points their own camera at the code and approves the redirect, which feels less suspicious than tapping a link inside a strange text.

This is the same playbook that drove the 587% year over year increase in QR code phishing documented across 2025. Carrier defenses force innovation, and that innovation now lives inside QR codes.

Where the Reports Are Coming From

The Federal Trade Commission consumer alert at consumer.ftc.gov titled "That text about a traffic violation is probably a scam" applies nationally regardless of which state appears in the text body.

What Real Government Agencies Will Never Do

This scam survives because most people have never received a real traffic violation notice from a court or DMV and do not know what one looks like. Here is what every legitimate state agency in the United States actually does:

• They do not text you about violations. State DMVs and courts use postal mail for violation notices. Some courts send hearing reminders by text only if you explicitly opted in during a prior interaction.
• They do not use QR codes for ticket payment. Every state DMV and traffic court provides a website you can navigate to directly without scanning anything.
• They do not threaten arrest for a $6.99 fee. Real violation notices include a court date, an option to contest, and weeks or months of warning before any escalation.
• They do not ask for your full Social Security number on a payment page. A fee payment requires only the payment information, never identity verification fields.

The Red Flags in This Specific Scam

If you receive a text and any of the following are true, it is a scam:

• A QR code instead of a link
• A "Notice of Default" or "Final Warning" framing
• A small fee ($6.99 is the current pattern, but $4.99 and $9.99 variants have also been reported)
• Threats of court referral, license suspension, or arrest within hours
• A sender phone number that does not match any state government area code
• Generic greeting with no name or specific case details

How to Verify Before You Pay

If you suspect a text might be real, never tap or scan. Use these three options instead.

Option 1: Long press the QR code. On iPhone and most Android phones, long pressing a QR code in a text message reveals the destination URL without opening it. If the URL is not a .gov domain, it is not legitimate.

Option 2: Paste the URL or the full text into ScamVerify. Our text checker analyzes message content for impersonation patterns. Our URL checker checks the destination against 162,000 known malicious domains in our threat database.

Option 3: Call the court directly. Look up your local traffic court's phone number on the official state government website (not from any link in the text) and call them. They can confirm whether you have any outstanding violations.

What to Do If You Already Scanned

If the QR code took you to a payment page but you have not entered any information, close the page immediately and do not return.

If you have already entered your card details:

1. Call your bank or credit card company immediately and report fraud. Most issuers can freeze the card and dispute charges within minutes.
2. Place a fraud alert with the three credit bureaus (Equifax, Experian, TransUnion) if you provided any identity information beyond your card.
3. Report the scam to the FTC at ReportFraud.ftc.gov. This data feeds into the same database ScamVerify pulls from to alert future victims.
4. Keep the original text message. Do not delete it. The metadata helps investigators trace the campaign.

FAQ

Will my state DMV ever text me about a traffic violation?

No. State DMVs and courts do not initiate contact with citizens about violations through text messages. They use postal mail. If you receive a text claiming to be from a state agency about an unpaid ticket, treat it as a scam by default. The only legitimate use of court text messages is hearing reminders for cases you already know about, and only if you opted in.

Why does the scam ask for only $6.99 instead of a larger amount?

The small amount lowers the friction to comply. People are more willing to pay $6.99 to make a problem disappear than they are to investigate whether the problem is real. The $6.99 is bait. The actual value the scammer captures is your credit card number, billing address, and any identity information on the page, which they sell to other criminals or use for larger fraud against you within hours of the original transaction.

Is scanning a QR code safer than tapping a link in a suspicious text?

No, the opposite is now true. Scanning a QR code routes the victim through a destination URL that carriers cannot inspect, security tools cannot easily analyze, and the victim themselves often cannot preview before the page loads. Treat QR codes inside text messages as more dangerous than plain links, not less, until you have verified the destination using one of the methods above.