Loading story…
The FBI issued a public service announcement warning of an emerging phishing and payment-fraud scheme in which criminals impersonate U.S. city and county planning/zoning officials to target businesses and individuals with active land-use, planning, or zoning permit applications. The attackers use publicly available permit information to make messages appear legitimate, referencing real details such as property addresses, permit or case numbers, and names of actual officials; emails may include official-looking formatting and PDF invoices with itemized “fees.”
Victims are directed to pay purported permit-related fees via wire transfer, peer-to-peer payment apps, or cryptocurrency, and the emails may instruct recipients to request payment instructions via email (rather than phone) to discourage verification with government offices. Reported indicators include sender addresses from non-governmental domains (e.g., lookalike domains) and urgency tactics tied to permit timelines. The FBI advised recipients to validate sender domains and independently confirm any outstanding fees by contacting the relevant city/county office, and to report incidents to the FBI’s IC3 with available details (e.g., sender email, dates, and any phone numbers used).
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
The FBI, via the Internet Crime Complaint Center, publicly warned of an emerging nationwide phishing scheme in which criminals impersonate U.S. city and county planning and zoning officials to steal permit payments. The alert said attackers use publicly available permit details to craft convincing emails and invoices, pressure victims to pay via wire transfer, peer-to-peer apps, or cryptocurrency, and advised recipients to verify requests through official government channels and report incidents to IC3.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
7 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcetherecord.media
Open sourcesecurityaffairs.com
Open sourceic3.gov
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A wave of impersonation scams is targeting individuals through phone calls and text messages, with fraudsters posing as debt collectors, tax agencies, law enforcement, and government departments. Victims report receiving unsolicited communications threatening legal action, arrest, or suspension of licenses unless immediate payment or personal information is provided. Tactics include aggressive language, urgent demands, and the use of official-sounding names or references to government codes to increase credibility. Notable examples include calls from entities like "Champion Strategy Holdings" and "Tax Solutions," as well as text messages purporting to be from the Florida Department of Highway Safety and Motor Vehicles (FLHSMV), all leveraging fear of legal consequences to coerce compliance. Authorities and cybersecurity experts warn that legitimate agencies do not demand payment or sensitive information via unsolicited calls or texts, nor do they threaten arrest or license suspension without due process. Individuals are advised to verify any such claims through official channels, avoid clicking on suspicious links, and never provide personal or financial information in response to these threats. The prevalence and sophistication of these scams highlight the ongoing need for vigilance and public awareness to prevent financial loss and identity theft.
Jul 1, 2026
The FBI's Internet Crime Complaint Center (**IC3**) has warned that scammers are posing as FBI personnel and IC3 representatives to target people who have already lost money to cybercrime and fraud. The operation uses fake social media profiles, direct messages, phone calls, emails, online forums, spoofed IC3 websites, and **AI-generated videos** of senior FBI officials to falsely claim that stolen funds have been recovered or can be recovered, with the goal of stealing additional personal and financial information. The FBI said the fraudsters often contact victims on platforms such as Facebook Messenger before moving conversations to apps like Telegram, where they may send links that harvest data or contain malicious code. Deepfake videos have also been used to steer victims to fake complaint portals designed to mimic `ic3.gov` and collect sensitive details about prior losses. IC3 stressed that it has **no social media presence**, does not initiate contact through social media, chat apps, phone, or email to recover money, and never asks victims to pay fees for fund recovery; legitimate follow-up would come from an FBI employee or another law enforcement official.
Aug 11, 2026
A smishing campaign is sending fake traffic violation, toll evasion, and DMV-related text messages to drivers across multiple U.S. states and other countries, impersonating courts, motor vehicle agencies, and toll operators such as **E-ZPass**. The messages pressure recipients with claims of unpaid fines, license suspension, or arrest, often cite small balances such as **$6.99**, and direct targets to malicious links or QR codes designed to harvest personal and financial information. Reported activity spans New York, California, North Carolina, Illinois, Virginia, Texas, Connecticut, and New Jersey, with similar lures also observed in Canada and India. Researchers said the campaign increasingly uses embedded QR codes to bypass security filters, sometimes sending victims through a CAPTCHA-protected intermediary page before redirecting them to spoofed payment portals. Observed phishing infrastructure included domains such as `ny.gov-skd[.]org` and `ny.ofkhv[.]life`, while the texts often originated from random or international numbers. State agencies said they do not request payment or sensitive information by text message, and recipients are being urged not to click, scan, or reply, to verify any alleged violation through official websites or contact channels, and to report the scam to their mobile carrier, the **FTC**, and the **FBI IC3**; anyone who submitted payment data should contact their bank immediately and replace affected cards.
Jul 4, 2026