Cybersecurity awareness
3 Las Vegas phishing scams targeting businesses in 2026
Fake QR codes, police and jury duty calls, and help desk impersonation, with the red flags to teach your team.
Get a free security consultation (702) 725-2877
By Adam Lopez, Fractional CIO and vCISO, CMIT Solutions of Las Vegas · Updated October 2026
The short answer
Three phishing scams are hitting Las Vegas businesses: fake QR codes (quishing), calls impersonating police or courts over missed jury duty, and callers impersonating employees to trick a help desk into resetting passwords. Each one relies on pressure and trust, so the best defense is verification rules plus technical safeguards.
Why it matters
Think you are too small to be hacked?
When the 2023 attacks on MGM and Caesars shut down systems on the Strip, many small business owners felt relieved. They should not. The same social engineering tactics work on any business, and a local dental office or accounting firm usually has far fewer defenses than a casino. The FBI and CISA published an advisory in November 2023 describing the help desk impersonation methods used by the group behind those attacks, known as Scattered Spider, and the tactics have been widely copied since.
Scam 1
1. Quishing: fake QR codes
Quishing is phishing by QR code. You see QR codes on restaurant tables, parking meters and flyers, and criminals paste fake stickers over real ones.
How the scam works
An employee scans a code on a parking meter to pay. It opens a payment page that imitates the official one, and the employee enters a card number. Some malicious codes try to push the device toward harmful downloads.
Red flags
Run a finger over the code: a sticker pasted over a printed sign is a warning. Check the web address before you pay, and watch for hyphens, extra words or slight misspellings. Pay through the official app or website when in doubt. Company phones should have device management that can warn about or block malicious links.
Scam 2
2. The fake jury duty and police call
In 2026 the Las Vegas Metropolitan Police Department and the Eighth Judicial District Court have both warned the public about callers who claim a person missed jury duty and faces arrest.
How the scam works
The caller says they are an officer or court employee, often giving a believable name or badge number, and demands a fine right away by gift card, cryptocurrency or a payment app. Criminals can also use AI-generated or cloned voices to sound calm and convincing.
Red flags
Real police and courts do not demand payment by gift card, crypto or a payment app. Threats of immediate arrest, and orders to stay on the line, are pressure tactics. Hang up and call the agency using a number you look up yourself. Staff should never pay anything from company funds on a phone request.
Scam 3
3. Help desk impersonation
This is the method the FBI and CISA described in the casino attacks. It works because it exploits helpfulness, not software.
How the scam works
The attacker researches staff on social media, then calls your help desk or IT contact pretending to be a new hire who lost a phone and cannot get a multi-factor authentication code. If the reset is granted, the attacker is inside.
Red flags
Any request to bypass multi-factor authentication is a red flag. So is a caller who refuses to verify on video or through a call back to a known number. Require multi-step identity verification for every credential reset, no matter how urgent it sounds.
Defense
How to protect your business
No single tool stops all three scams. Combine clear verification rules with technical controls.
Verification rules
Written steps for password and multi-factor resets, payment changes and wire requests, with a call back to a known number.
Security awareness training
Regular training and simulated phishing so staff recognize urgency and unusual requests.
Technical safeguards
Email filtering, multi-factor authentication, endpoint protection, device management and tested backups.
Pricing
What protection costs
CMIT prices per seat, from $49 to $120 per seat per month. Start with the protection you need and add support hours and applications as you grow.
Good
Cybersecurity only
From $49
per seat, per month
- Managed cybersecurity protection for every seat
- Core business applications covered
- Best when you already have IT help
Better
Help desk plus cybersecurity
Priced per seat
between the Good and Best plans
- Everything in Good
- Help desk support during business hours
- More applications covered as you add them
Best
24/7 help desk plus cybersecurity
Up to $120
per seat, per month
- Everything in Better
- 24/7 support from our Las Vegas team
- Broadest application coverage
Your price depends on the plan, whether support covers business hours or 24/7, and how many applications we cover. Ask for a written quote based on your seat count and applications.
Common questions
Phishing scams: frequently asked questions
What is quishing?
Quishing is phishing through QR codes. Criminals place fake QR stickers over real ones, such as on parking meters or table signs, so that scanning the code sends you to a look-alike payment or login page.
How do I spot a fake jury duty or police scam call?
Real courts and police do not demand payment by gift card, cryptocurrency or payment apps, and they do not threaten immediate arrest over the phone. If a caller does, hang up and call the agency using a number you look up yourself.
What was the Scattered Spider attack on the Las Vegas casinos?
In 2023, attackers tied to a group known as Scattered Spider reached casino systems by impersonating staff to help desks and tricking them into resetting credentials. The FBI and CISA published an advisory describing these social engineering tactics.
How can a small business stop help desk impersonation?
Require identity verification before any password or multi-factor authentication reset, such as a call back to a known number or a video check, and never allow resets on an urgent request alone.
Does security awareness training reduce phishing risk?
It helps. Training teaches staff to recognize urgency, unusual payment requests and odd links, but it works best alongside technical controls such as email filtering, multi-factor authentication and device management.
How much does protection against phishing cost for a Las Vegas business?
CMIT Solutions prices per seat, from $49 to $120 per seat per month, depending on the plan (cybersecurity only, or help desk plus cybersecurity), whether support covers business hours or 24/7, and how many applications we cover. We confirm the details in a written quote.
Find your weak spots before attackers do.
Talk to our Las Vegas team about phishing protection, training and verification procedures for your business.
Prefer to talk? Call (702) 725-2877 or email LVSales@cmitsolutions.com
Related reading
Managed cybersecurity services · Cybersecurity in Las Vegas · Managed IT services · WISP compliance for law firms · Best managed IT services companies in Las Vegas
Sources
FBI and CISA, joint advisory on Scattered Spider (November 2023). FOX5 Vegas, Behind the Badge: LVMPD warns of rise in jury duty scams (July 2026) and Eighth Judicial District Court warns public of jury duty scam (August 2026). CMIT Solutions pricing is per seat per month and varies with plan, support hours and the number of applications covered.
CMIT Solutions of Las Vegas · IT services and cybersecurity serving Las Vegas, Henderson, North Las Vegas, Summerlin and Clark County