{"id":1121,"date":"2025-12-22T22:27:02","date_gmt":"2025-12-23T04:27:02","guid":{"rendered":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/?p=1121"},"modified":"2026-10-22T10:38:58","modified_gmt":"2026-10-22T15:38:58","slug":"las-vegas-phishing-scams-targeting-businesses","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/blog\/las-vegas-phishing-scams-targeting-businesses\/","title":{"rendered":"3 Las Vegas Phishing Scams Targeting Businesses in 2026"},"content":{"rendered":"
\n
\n

Cybersecurity awareness<\/p>\n

3 Las Vegas phishing scams targeting businesses in 2026<\/h2>\n

Fake QR codes, police and jury duty calls, and help desk impersonation, with the red flags to teach your team.<\/p>\n

Get a free security consultation<\/a> (702) 725-2877<\/a><\/p>\n

By Adam Lopez<\/strong>, Fractional CIO and vCISO, CMIT Solutions of Las Vegas · Updated October 2026<\/p>\n<\/div>\n

\n

The short answer<\/p>\n

Three phishing scams are hitting Las Vegas businesses: fake QR codes (quishing), calls impersonating police or courts over missed jury duty, and callers impersonating employees to trick a help desk into resetting passwords. Each one relies on pressure and trust, so the best defense is verification rules plus technical safeguards.<\/p>\n<\/div>\n

Why it matters<\/p>\n

Think you are too small to be hacked?<\/h2>\n
<\/div>\n

When the 2023 attacks on MGM and Caesars shut down systems on the Strip, many small business owners felt relieved. They should not. The same social engineering tactics work on any business, and a local dental office or accounting firm usually has far fewer defenses than a casino. The FBI and CISA published an advisory in November 2023 describing the help desk impersonation methods used by the group behind those attacks, known as Scattered Spider, and the tactics have been widely copied since.<\/p>\n

Scam 1<\/p>\n

1. Quishing: fake QR codes<\/h2>\n
<\/div>\n

Quishing is phishing by QR code. You see QR codes on restaurant tables, parking meters and flyers, and criminals paste fake stickers over real ones.<\/p>\n

\n
\n

How the scam works<\/h3>\n

An employee scans a code on a parking meter to pay. It opens a payment page that imitates the official one, and the employee enters a card number. Some malicious codes try to push the device toward harmful downloads.<\/p>\n<\/div>\n

\n

Red flags<\/h3>\n

Run a finger over the code: a sticker pasted over a printed sign is a warning. Check the web address before you pay, and watch for hyphens, extra words or slight misspellings. Pay through the official app or website when in doubt. Company phones should have device management that can warn about or block malicious links.<\/p>\n<\/div>\n<\/div>\n

Scam 2<\/p>\n

2. The fake jury duty and police call<\/h2>\n
<\/div>\n

In 2026 the Las Vegas Metropolitan Police Department and the Eighth Judicial District Court have both warned the public about callers who claim a person missed jury duty and faces arrest.<\/p>\n

\n
\n

How the scam works<\/h3>\n

The caller says they are an officer or court employee, often giving a believable name or badge number, and demands a fine right away by gift card, cryptocurrency or a payment app. Criminals can also use AI-generated or cloned voices to sound calm and convincing.<\/p>\n<\/div>\n

\n

Red flags<\/h3>\n

Real police and courts do not demand payment by gift card, crypto or a payment app. Threats of immediate arrest, and orders to stay on the line, are pressure tactics. Hang up and call the agency using a number you look up yourself. Staff should never pay anything from company funds on a phone request.<\/p>\n<\/div>\n<\/div>\n

Scam 3<\/p>\n

3. Help desk impersonation<\/h2>\n
<\/div>\n

This is the method the FBI and CISA described in the casino attacks. It works because it exploits helpfulness, not software.<\/p>\n

\n
\n

How the scam works<\/h3>\n

The attacker researches staff on social media, then calls your help desk or IT contact pretending to be a new hire who lost a phone and cannot get a multi-factor authentication code. If the reset is granted, the attacker is inside.<\/p>\n<\/div>\n

\n

Red flags<\/h3>\n

Any request to bypass multi-factor authentication is a red flag. So is a caller who refuses to verify on video or through a call back to a known number. Require multi-step identity verification for every credential reset, no matter how urgent it sounds.<\/p>\n<\/div>\n<\/div>\n

Defense<\/p>\n

How to protect your business<\/h2>\n
<\/div>\n

No single tool stops all three scams. Combine clear verification rules with technical controls.<\/p>\n

\n
\n

Verification rules<\/h3>\n

Written steps for password and multi-factor resets, payment changes and wire requests, with a call back to a known number.<\/p>\n<\/div>\n

\n

Security awareness training<\/h3>\n

Regular training and simulated phishing so staff recognize urgency and unusual requests.<\/p>\n<\/div>\n

\n

Technical safeguards<\/h3>\n

Email filtering, multi-factor authentication, endpoint protection, device management and tested backups.<\/p>\n<\/div>\n<\/div>\n

Pricing<\/p>\n

What protection costs<\/h2>\n
<\/div>\n

CMIT prices per seat, from $49 to $120 per seat per month. Start with the protection you need and add support hours and applications as you grow.<\/p>\n

\n
\n

Good<\/p>\n

Cybersecurity only<\/h3>\n

From $49<\/p>\n

per seat, per month<\/p>\n