Text & QR Scams 2026: Toll, Delivery, DMV, Parking QR

Which text scams are going around in October 2026?

The short answer

Spot it: an unexpected text about money you owe, a parcel, a fine or your voter registration, with a link and a deadline. USPS says its tracking texts never contain a link, and state DMVs say they don't demand payment by text USPIS (updated 19 May 2025) CT DMV (6 Mar 2026) NCDOT (21 Jan 2026).

Check it: don't tap. Type the agency's address yourself, or paste the bare domain into our website checker. For a QR code, read it with our QR decoder before opening anything.

Report it: forward the text to 7726 (SPAM), report it in your messaging app, and file at ic3.gov. On 16 October 2026 the FTC's ReportFraud site showed a government-shutdown notice instead of its form ReportFraud.ftc.gov (checked 16 Oct 2026).

Already tapped or paid? Call your bank or card issuer, change any password you typed, and watch your statements FTC (3 Sep 2026) USPIS (updated 19 May 2025).

The five lures in circulation, and what the real agency says. Checked 16 October 2026.

Lure	What the text says	What the real agency says
Unpaid toll	You owe a small toll balance, with a late fee if you don't pay now. IC3's sample asked for $12.51 and threatened a "late fee of $50.00" IC3 (Apr 2024).	Check your account on the toll service's own website or phone line, not the link IC3 (Apr 2024) FTC (17 Jan 2025).
Parcel delivery (USPS)2024's most-reported text scam FTC Data Spotlight (14 Apr 2025)	A delivery needs your response, with an unfamiliar link USPIS (updated 19 May 2025).	USPS texts only if you asked for tracking with a tracking number, and such a text "will NOT contain a link" USPIS (updated 19 May 2025).
DMV or traffic ticket	An overdue ticket, a "DMV violation database", suspension of your licence, a 35% service fee FTC (21 Jul 2025).	"The DMV does not send payment demands through text message" (Connecticut) CT DMV (6 Mar 2026). "We will NEVER request payment by text" (North Carolina) NCDOT (21 Jan 2026).
"You're not registered to vote"	You aren't registered, with a link to a fake state registration page that collects personal details IC3 (15 Oct 2026).	Check your status at vote.gov IC3 (15 Oct 2026). See our midterm scams guide.
Parking-meter QR codenot a text, same trick	A sticker over the meter's real QR code leads to a site that takes your money, your data or both FTC (3 Sep 2026).	Check the link the QR reader shows before opening it FTC (3 Sep 2026).

These are old tricks at a new scale. The FBI's Internet Crime Complaint Center (IC3) warned about toll texts in April 2024. It had "over 2,000 complaints" from at least three states IC3 (Apr 2024). By 2024, fake delivery notices were the most-reported text scam, and bogus toll notices were fourth FTC Data Spotlight (14 Apr 2025). The FTC says the top five types made up about half of all text-fraud reports that year FTC Data Spotlight (14 Apr 2025).

The toll text targets people who never used a toll road. The FTC's alert opens: "Whether you’ve driven through a toll recently or not, you might’ve gotten a text saying you owe money for unpaid tolls" FTC (17 Jan 2025). Paying is not the only risk. If you click, scammers may also get personal details such as your driver's licence number and use them for identity theft FTC (17 Jan 2025).

The DMV version leans on fear. Texts threaten prosecution, a damaged credit score, or suspension of your registration FTC (21 Jul 2025). North Carolina's DMV warned of a new wave in January 2026 NCDOT (21 Jan 2026). Connecticut's followed in March 2026 CT DMV (6 Mar 2026).

Why do so many of these texts arrive at once?

Because they are sold as a kit. On 14 October 2026, Microsoft and Health-ISAC announced they had seized domains of YAM Store, a Chinese-language cybercrime marketplace BleepingComputer (14 Oct 2026). Health-ISAC, a health-sector security group, joined because hospitals were among the targets SecurityWeek (14 Oct 2026). A federal court in the Southern District of Florida approved the seizure on 7 October Cybersecurity Dive (14 Oct 2026).

Microsoft tracks YAM Store as Storm-3119. It sold hijacked Microsoft and Google accounts, licences and storage to phishing crews Microsoft Threat Intelligence (14 Oct 2026). Those crews used ready-made phishing kits called CoGUI, Haozi and Iron Man SecurityWeek (14 Oct 2026). Microsoft says the network helped send "over one billion phishing emails and SMS messages" since January 2026 Microsoft Threat Intelligence (14 Oct 2026).

The lures match your inbox. Microsoft says the crews ran campaigns at scale, "whether it is a missing toll payment or a traffic citation" Microsoft Threat Intelligence (14 Oct 2026). BleepingComputer lists unpaid tolls, traffic penalties, delivery problems and account checks BleepingComputer (14 Oct 2026). Iron Man alone offered "over 2,335 templates tailored to over 139 countries", by Microsoft's count Microsoft Threat Intelligence (14 Oct 2026).

What the takedown changes. Microsoft disabled more than 20,000 accounts tied to YAM Store and blocked over 100,000 fraud domains SecurityWeek (14 Oct 2026). Cybersecurity Dive says the seizure cut off their operations, at least for now Cybersecurity Dive (14 Oct 2026). Other phishing tools exist, so keep checking links.

How do I check a link without opening it?

Rule one: never tap the link to "see what it is". If you think a message might be real, the FTC says to "contact the company using a phone number or website you know is real" FTC (checked 16 Oct 2026). Some scam texts also try to install malware that steals your information FTC (checked 16 Oct 2026).

Read the address, not the text. Look for misspellings or swapped letters, as the FTC advises for QR links FTC (3 Sep 2026). A real toll agency or DMV address will match the one on its official site.
Check the domain's age and history. Paste only the domain (the part before the first single slash) into our Website Legit Checker. It shows the domain's registration date, its first TLS certificate (the padlock certificate), Wayback history and look-alike hints. A "toll" site first seen last week is a strong warning sign.
Decode a QR code first. Take a photo or screenshot of the code and drop it into our QR Code Decoder. It reads the code in your browser, shows the full address, and flags link shorteners and hidden usernames in the link.
Then go to the real site yourself. Type the agency's address or use its official app. Check your toll, ticket or parcel there IC3 (Apr 2024) FTC (21 Jul 2025).

What about the number that sent it? Sending numbers change from state to state IC3 (Apr 2024), so a clean number proves nothing. Our phone lookup can show carrier and spam reports, but treat the link as the real test.

How do I report a scam text?

Where to report a scam text in the US, and whether it worked when we checked on 16 October 2026.

Where	How	Status or note
Your carrier: 7726	"Copy the message and forward it to 7726 (SPAM)" FTC (checked 16 Oct 2026).	Helps your carrier block similar texts FTC (checked 16 Oct 2026)
Your messaging app	Use the "report junk" or "report spam" option, then delete FTC (17 Jan 2025).	Look for "report junk" or "report spam" FTC (checked 16 Oct 2026)
FBI IC3	File at ic3.gov. Include the sending number and the website in the text IC3 (Apr 2024).	Form available 16 Oct IC3 home page (checked 16 Oct 2026)
USPS Inspection Service	For USPS texts: email [email protected] with the text pasted in and a screenshot showing the number and date USPIS (updated 19 May 2025).	USPS-themed texts only
FTC ReportFraud	ReportFraud.ftc.gov is the FTC's usual reporting site FTC (checked 16 Oct 2026).	Shutdown notice, no form, 16 Oct ReportFraud.ftc.gov (checked 16 Oct 2026)
Your state attorney general	Some states collect scam-text reports. North Carolina asks for them NCDOT (21 Jan 2026).	Varies by state

What we saw at the FTC. On 16 October 2026, ReportFraud.ftc.gov showed only this notice: "Due to the government shutdown, we are unable to offer this website service. We will resume normal operations when the government is funded" ReportFraud.ftc.gov (checked 16 Oct 2026). Our records show the same notice on 10 October. The FTC's advice site, Consumer.ftc.gov, was still online Consumer.ftc.gov (checked 16 Oct 2026). Until the form returns, use 7726, your app's report button and IC3.

Report even if you lost nothing. IC3's toll alert asks for the phone number and the website address from the text IC3 (Apr 2024). USPIS asks you to say whether you clicked, lost money or shared personal information USPIS (updated 19 May 2025).

What should I do if I already tapped the link or paid?

Stop replying. Scammers may push for more money or data FTC (3 Sep 2026).
Call your bank or card issuer. USPIS says to do this even if you only opened the link and never pressed "submit" USPIS (updated 19 May 2025). Dispute any charge you don't recognise IC3 (Apr 2024).
Change passwords you typed. Start with any account where you reuse that password FTC (3 Sep 2026). Our password guide covers passkeys and two-factor sign-in.
Watch your statements for transactions you don't recognise FTC (3 Sep 2026).
Keep the evidence and report. Keep all financial records and messages, then file at IC3 IC3 (17 Sep 2026).

If you gave your driver's licence number, treat it as an identity-theft risk, as the FTC warns FTC (17 Jan 2025).

Which phone settings filter scam texts?

Android (Google Messages)

Spam protection is on by default. To check it, open Google Messages, tap your profile picture, then Messages settings > Protection & Safety > Spam protection. Make sure "Enable spam protection" is on Google Messages Help (checked 16 Oct 2026). The option only appears on devices that support it Google Messages Help (checked 16 Oct 2026).

To report a text, touch and hold the conversation, then tap Block > Report spam > OK Google Messages Help (checked 16 Oct 2026). On select Android phones, search the Settings app for "Scam Detection" to find the "Message scams" switch. Google says Scam Detection for chat messages is on by default, in the US and many other countries Android Help (checked 16 Oct 2026).

New: "Enhanced protection". On 14 October 2026 Google announced an opt-in setting for Google Messages, "rolling out in the coming weeks" Google (14 Oct 2026). It adds three things Google (14 Oct 2026):

Gemini scam detection for texts from unknown senders, run in Google's Private AI Compute cloud.
On-device link checks with Gemini Nano, on Pixel 10 and later, Galaxy S26 and other select devices.
Stronger warnings before you open a link from a number not in your contacts, on Android 6 and later.

Google has not published where the switch will be. We will add the path once Google's help pages show it.

iPhone (Messages)

Apple's iPhone User Guide covers screening and filtering texts from unknown senders, and reporting junk Apple iPhone User Guide (checked 16 Oct 2026). We could not read Apple's step-by-step text with our tools, so we don't repeat a menu path here. Follow Apple's own page for your iOS version.

To block a sender, open the conversation, tap the contact at the top, scroll down and tap "Block Caller" Apple Support (29 May 2026). On iOS 26 you can also add numbers under Settings > Privacy & Security > Blocked Contacts Apple Support (29 May 2026).

Blocking has limits. Scam senders switch numbers often IC3 (Apr 2024). Reporting each text helps your carrier block the next one FTC (checked 16 Oct 2026).

Sources

Every source was read on 16 October 2026 unless a different date is shown. This page is general consumer information, not legal advice.

Frequently Asked Questions

What is smishing?

Smishing is phishing by text message. The sender poses as a government agency, bank or company and sends an unexpected text with an unfamiliar link, hoping you will pay or type in personal details. The US Postal Inspection Service uses the term for fake delivery texts.

What happens when I forward a scam text to 7726?

Forwarding a text to 7726, which spells SPAM, sends it to your wireless carrier. The FTC says this helps your provider spot and block similar messages in the future. It does not open a fraud case, so also report to IC3 if you lost money.

Why did I get a toll text when I have never driven on a toll road?

Because the senders do not know where you drive. The FTC warns that these texts arrive whether or not you have driven through a toll recently. Scammers pose as tolling agencies across the country and send texts demanding money.

Does Google Messages send my links to Google?

Yes, when spam protection is on. Google says that if a message contains a URL, spam protection uploads that URL to Google to check whether it is malicious. Spam detection itself runs on the device. You can turn spam protection off in Messages settings, under Protection and Safety.

Can I still report a scam text while ReportFraud.ftc.gov is down?

Yes. On 16 October 2026 the FTC site showed a government-shutdown notice, but the FBI complaint form at ic3.gov was available. Forwarding to 7726 and the report button in your messaging app also still work. The FTC notice says normal operations will resume when the government is funded.

Will the YAM Store takedown stop these texts?

It should slow some of them, but not end them. A federal court let Microsoft and Health-ISAC seize the marketplace domains, which Cybersecurity Dive said cut the sites off at least temporarily. BleepingComputer reports that further removals are under way with partners. Other phishing tools exist, so keep checking links.

Next step

Got a suspicious text right now? Don't tap it. Paste just the domain into our free Website Legit Checker to see how old the site is. Then forward the text to 7726 and delete it.