Smishing scams: latest SMS + QR code phishing cases
Smishing accounted for the bulk of consumer fraud reports in 2024-2025. We catalogue the active campaigns: fake delivery slots, bank fraud-alert traps, tax-refund lures, and QR-code phishing at parking meters and restaurant tables.
Quishing hides a phishing link inside a QR code, bypassing many link filters and exploiting trust in physical/printed codes. Vectors in 2026: fake 'secure document' or MFA-reset emails, stickers...
The 'unpaid toll' / 'traffic violation' text scam (E-ZPass, road tolls, parking fines) remains one of the highest-volume smishing campaigns. As people learned to distrust links in texts, 2026...
Europol warns that caller-ID and SMS sender-ID spoofing now underpins roughly 64% of reported phone/text fraud and costs an estimated EUR 850M globally per year, offered by organised networks as...
Scammers are impersonating court officials and law enforcement to threaten you with arrest for missing jury duty, pressuring you to pay a fine on the spot. They use phone calls, texts, and emails...
Criminals are targeting Signal users with SMS phishing that impersonates Signal Support and tricks victims into handing over their 64-character backup recovery key. Once shared, attackers can...
Scammers reach out through texts, phone calls, social media ads, and direct messages, so anyone with a phone or a social account is a likely target. Their first contact is designed to build trust...
Attacker pastes a sticker QR code over the real one on a city parking meter (Austin, Atlanta, San Antonio), restaurant table, or mails fake 'USPS undelivered parcel' postcards with QR. Scanning leads...
SMS impersonating Canada Post / Postes Canada claims a parcel needs C$1.95 redelivery or duties fee, with link to canadapost-redelivery[.]xyz, harvesting card + CVV + Interac credentials. CAFC...
SMS/email impersonating Services Australia / myGov claims a Centrelink payment is pending and a link is required to verify identity, capturing CRN, Medicare and licence. ACCC ScamWatch: A$5M+ in...
SMS claims a Royal Mail / Evri / DHL parcel has a £1.99-£3.45 customs or redelivery fee, with link to a fake gov.uk-style page that harvests card + Verified-by-Visa OTP. Action Fraud received...
SMS from spoofed shortcode claiming USPS package can't be delivered, with link like usps.tracking-redelivery[.]com or usps-services[.]xyz. Landing page harvests address, card details and CVV. USPS...
After natural disasters, war coverage, or viral GoFundMe stories, scammers print posters with QR codes for fake 'donation' pages (sometimes wallet drainers, sometimes card phishing). Often deployed...
Scammer takes a screenshot of a legitimate QR ticket and resells it to multiple buyers via Telegram / Facebook Marketplace. Only one buyer can enter; the rest are turned away. Or they generate a...
Scammers stick fake QR codes on EV charging stations (and gas pumps). Driver scans, lands on a clone of the charger network's payment page, enters card; either no charge starts, or the card is later...
Scammer places fake QR sticker on table at busy restaurant. Customers scan, land on a clone of the restaurant's order page that captures card + personal info, or on a wallet-drainer 'connect to view...
Scammers print stickers with QR codes redirecting to a parking-payment phishing site, stick them over the legitimate code on city parking meters (Austin: 29 meters Dec 2024; Redondo Beach, Houston,...