The NJCCIC received a new wave of reports about SMS phishing (SMiShing) scams. In this campaign, threat actors impersonated both the New Jersey State Police and the NJ Motor Vehicle Commission (MVC). These urgent-sounding messages claim to be vehicle enforcement advisory notices and set a short deadline to resolve a supposed compliance issue. The messages further state that if the issue is not resolved, consequences will include suspension of driving privileges, additional fees and penalties, registration restrictions, and formal compliance adjudication. A link in the messages purports to lead to the official New Jersey State Police website; however, it uses a “.vip” top-level domain (TLD) instead of the official “.gov.”

Reports indicate that the website uses official NJ MVC logos and branding to collect personally identifiable information (PII) and financial information.

Recommendations

• Avoid clicking links, responding to, or acting on unsolicited text messages.
• Confirm requests from senders via contact information obtained from verified and official sources.
• Type official website URLs into browsers manually.
• Users who submitted payment information to these webpages are advised to contact their banking institutions to report the fraudulent purchases.
• Report SMiShing to the NJCCIC, the FBI’s IC3, and forward the message to 7726 (SPAM).