Malicious messages are flooding phones across the U.S., tricking users into paying fake fines through links sent by cybercriminals.
What happened
The FBI is warning smartphone users to delete scam text messages designed to mimic official notices from agencies like the DMV. These smishing attacks urge recipients to click links related to unpaid tolls, traffic fines, or other urgent notices. The messages are fraudulent and part of a widespread cybercriminal operation attributed to China-based groups.
The scam has reached an alarming scale, with an estimated 60 million messages sent each month across the U.S. Victims are tricked into entering sensitive data or making payments, thinking they are resolving legitimate issues. Messages have appeared across nearly all states and target both iPhone and Android users.
Going deeper
Security researchers say the attacks rely on phishing-as-a-service infrastructure, with text messages linking to cloned state DMV pages and fake payment portals. The messages often include instructions like “reply Y” to bypass link-blocking features, particularly on iPhones. Domains used are typically low-cost and change frequently, using extensions like [.cfd] and [.win].
The scale and coordination behind the scam are industrial. A single actor can send hundreds of millions of texts annually. According to Check Point researchers, these operations use Chinese DNS providers, Chinese-language source code comments, and IPs linked to known phishing campaigns. Many of the cloned web pages are designed to impersonate specific state agencies using localized design elements.
Despite spam filtering by Apple and Google, the volume of messages continues to surge. New warnings have been issued in Florida, Georgia, Virginia, and Iowa, as attackers keep adapting the lure and targeting new recipients.
What was said
The FBI reiterated its core advice: don’t click, don’t reply, and don’t leave the message on your phone. Even unopened messages with malicious links pose little danger, but deleting them removes the risk of accidental engagement. Officials also warned of related scams where attackers impersonate law enforcement, demanding fake fines or threatening arrest unless payments are made.
Authorities in Iowa say, “Even if you have a recent ticket, the DMV will never contact you by text for fee collection or ask for financial information.” Similar messages have been echoed by agencies across the country as scam attempts increase.
The big picture
Smishing attacks are becoming more widespread as cybercrime operations scale up. It is now cheaper to send high volumes of scam messages, while the rewards remain high. Many of these scams imitate trusted institutions and rely on emotional manipulation to bypass security tools. With technical defenses often a step behind, user awareness is needed. The FBI recommends deleting suspicious texts immediately and avoiding any links or requests from unknown numbers.
FAQs
Why are scammers impersonating the DMV and the FBI specifically?
These institutions carry authority and urgency—two psychological levers that scammers exploit to prompt fast action without critical thinking.
What does a typical smishing message look like?
Many include phrases like “Unpaid Toll Notice” or “Immediate DMV Action Required,” often followed by a link or request to reply. They may appear localized, referencing your state or city.
What should I do if I clicked the link or provided personal info?
Immediately report the incident to your bank or credit card provider, monitor for suspicious activity, and consider filing a report with the FTC or local law enforcement.
Why can’t phone carriers or platforms block all these messages?
Scammers use constantly changing numbers, domain names, and sender tactics that often outpace current filtering technologies, especially with international infrastructure.
Are other impersonation scams on the rise?
Yes. In addition to DMV texts, scammers are now impersonating FBI agents and targeting vulnerable groups like foreign students, often demanding payment with threats of arrest or visa revocation.
Farah Amod
