QR Code Traffic Ticket Scam: Drivers Warned Nationwide

QR Code Traffic Ticket Scam: Drivers Warned Nationwide

A driver received what looked like an official traffic notice on her phone: a formal image from "the State Court" claiming she had an unpaid violation with a hearing date approaching. A QR code sat at the bottom. She scanned it, solved a quick CAPTCHA, and filled out the $6.99 payment form — handing scammers her full name, home address, and credit card number in under two minutes. Columbus, Ohio police have since issued a citywide warning. Reported cases now span at least a dozen states.

This is not the toll road text scam you may have read about before. It's a deliberate evolution — and the QR code is not cosmetic. It's a technical choice designed to get past the filters protecting your phone.

What Is the Traffic Ticket QR Code Scam?

The traffic ticket QR code scam is a form of smishing (SMS phishing) where criminals send fake text messages impersonating state courts, the DMV, or traffic enforcement agencies. The text claims you have an unpaid traffic violation — a ticket, an outstanding toll, a parking fine — and warns of imminent consequences: a court date, a license suspension, additional fees.

What separates this version from the toll road text scams that flooded inboxes in 2025: instead of a clickable link, scammers embed a QR code image inside the message.

That's a strategic shift, not a stylistic one. Clickable links in phishing texts are routinely intercepted by mobile carriers and spam filters. A QR code image is just a picture — it passes through with no warnings, and your phone has no way to evaluate where it leads until after you scan it. The tactic is specifically designed to evade the defenses that catch traditional smishing.

The FTC issued an alert about this wave in April 2026. By May, police departments from Kansas to Ohio were issuing local warnings as the campaign intensified.

How the Traffic Ticket QR Code Scam Works

Step 1 — The fake notice arrives. Your phone receives a text containing an image styled as an official government notice. Common headers include "Notice of Default," "Traffic Violation Notice," or "Court Summons Reminder." The image references a violation date, a citation or case number, and threatens consequences — suspended license, additional court fees — if you don't pay immediately. A prominent QR code is displayed at the bottom.

Step 2 — The CAPTCHA screen. Scanning the QR code does not take you directly to a payment page. First, you hit a CAPTCHA ("Prove you're not a robot"). This step is deliberate on the scammers' part: it filters out the automated security bots that check phishing URLs for blocklisting, makes the site feel more legitimate to real humans, and psychologically commits you to the next step — you've already invested time solving a CAPTCHA.

Step 3 — The fake agency site. After the CAPTCHA, you're redirected to a page impersonating a state agency. It's styled to look like a DMV portal, a state court payment system, or a traffic enforcement office, complete with official-sounding domain names and sometimes lifted state seals or agency logos. The listed fine is small — typically $6.99 to $25 — which seems like a routine administrative fee rather than a warning sign.

Step 4 — Personal and financial data is stolen. To "pay," you're asked to enter your full name, home address, phone number, email address, and credit card details including the security code. Once you hit submit, scammers have everything they need. The small test charge that appears on your card is often followed days or weeks later by larger unauthorized purchases — or your data is sold to other criminal networks for future fraud.

Red Flags to Watch For

• An unexpected text about a traffic violation. Every U.S. state serves official traffic court notices by mail, not SMS. An unsolicited text is not how this process works.
• The message is an image containing a QR code, not a text link. No real government agency sends traffic fine payment notices as a QR code image in a text message.
• You hit a CAPTCHA before reaching the payment page. Legitimate government payment portals do not gate their forms behind CAPTCHA screens reached via text message.
• The fine amount is unusually small. Real traffic citations list specific fine schedules set by statute — not round, suspiciously convenient numbers like $6.99. Small amounts are also chosen to fly under card fraud thresholds.
• Intense urgency throughout. "Pay within 24 hours," "court date is tomorrow," "license suspension imminent." Actual government deadlines run weeks or months out and arrive with formal documentation.
• The URL isn't a .gov domain. After scanning, check the browser address bar immediately. Any non-government domain — even one with words like "court," "dmv," or "violations" in it — is not an official state site.
• No specific vehicle or plate information. Real citations name your license plate, vehicle, violation location, and officer. Scam messages are vague because they're sent to millions of random numbers.
• The text comes from an unknown 10-digit number. Government agencies communicate through established, published channels — not random mobile numbers.

What to Do If You've Been Targeted

If you received the text and didn't scan it: Delete the message and report it. Forward the text to 7726 (SPAM) to alert your carrier, then report it to the FTC at ReportFraud.ftc.gov{:target="_blank" rel="noopener noreferrer"}.

If you scanned the QR code but entered nothing: Close the browser tab immediately and clear your browser cache. Your risk exposure is very low — the danger is in form submission, not the scan itself.

If you submitted personal or financial information: Move quickly through these steps:

1. Call your bank or card issuer now and report the transaction as fraud. Ask them to block the card and issue a replacement — do not wait to see if more charges appear.
2. Place a fraud alert with any one of the three major credit bureaus (Equifax, Experian, or TransUnion) — they are required to notify the others. A fraud alert makes it harder for scammers to open accounts in your name.
3. Consider a credit freeze, which blocks new credit applications entirely. It's free, and you can lift it temporarily when you need it.
4. Change the password on any account tied to the email address you entered, especially if you reuse passwords.
5. File a report with the FTC at ReportFraud.ftc.gov and with the FBI's Internet Crime Complaint Center at IC3.gov{:target="_blank" rel="noopener noreferrer"}.
6. Watch your accounts and credit reports closely for at least 90 days.

For a full step-by-step recovery walkthrough, see our guide on what to do if you clicked a scam link.

How to Protect Yourself

Verify through official channels, never the text. If a traffic violation text makes you genuinely concerned, go directly to your state's official DMV or court website — type the .gov address into your browser yourself — or call the number on your vehicle registration. Do not use any link, number, or QR code from the suspicious message.

Understand how real violations are actually served. Official traffic court notices arrive by USPS mail in every U.S. state. If your state has a legitimate opt-in text notification system, you enrolled in it yourself. An unsolicited text claiming otherwise is not part of any official program.

Treat QR codes in text messages like you'd treat an unknown link. A QR code can direct you anywhere, and unlike a visible URL, it gives you no warning before you scan. Apply the same skepticism you'd give to an unknown link embedded in a suspicious text — because that's exactly what it is.

Enable transaction alerts on every payment card. If a test charge slips through, an instant alert is your fastest path to disputing it and stopping further fraud before it escalates.

Use your phone's built-in safe browsing settings. Both iOS and Android have phishing site detection built into their browsers. Keep it enabled — even if it can't intercept the QR code itself, it may flag the landing page.

Talk to family members who drive. Older adults and anyone who recently drove on toll roads or received a real traffic violation may be more likely to believe these messages. Warn them that courts do not text.

Frequently Asked Questions

Is it dangerous to scan the QR code if I don't fill out any forms?

The main risk is in submitting your information. Visiting the phishing site itself is low-risk for most people, as long as you close the page immediately and don't enter anything. That said, some tracking may occur on visit. If you scanned accidentally: close the browser, clear your cache, and don't go back.

What states have been targeted by this scam?

Reports have been confirmed from New York, California, North Carolina, Illinois, Virginia, Texas, Connecticut, New Jersey, Kansas, and Ohio — but the texts are distributed nationally using bulk messaging. Your state doesn't need to be on this list for you to receive one.

How do scammers get my cell phone number?

Through bulk phone number lists purchased from data brokers, leaked databases sold on the dark web, or automated number generators that dial and text sequentially. You were not specifically targeted — these campaigns reach millions of people at once.

I already paid the $6.99. What should I do?

Contact your card issuer immediately and report the charge as fraudulent. Most banks will reverse it and issue a new card number. Don't wait: your credit card credentials are now in criminal hands. Follow all the steps under "What to Do If You've Been Targeted" above, including placing a fraud alert.

Why do scammers only charge $6.99 if they have my card number?

The small charge tests whether your card is active and whether you'll notice. Larger charges — sometimes hundreds of dollars — often follow days or weeks later once they confirm the card works. Treat any unauthorized charge, however small, as an emergency.

How do I report a traffic ticket QR code scam text?

Forward it to 7726 (SPAM) to report it to your carrier. Then file with the FTC at ReportFraud.ftc.gov{:target="_blank" rel="noopener noreferrer"} and, if you lost money, with the FBI at IC3.gov{:target="_blank" rel="noopener noreferrer"}. For the full reporting walkthrough, see our guide to how to report a scam in 2026.

---