March 18 (UPI) -- Tollway companies across the United States are raising awareness about the resurgence of a text message phishing scam referred to as smishing.
Targets of the scam receive text messages claiming they have unpaid tolls and warning they must be paid or be subject to penalties, including loss of a driver's license. This scam is prevalent in several states.
Scammers purport to be with tollway services like Illinois' I-Pass, Florida's Sunpass, Virginia's E-ZPass and Massachusetts' EZDriveMA, among others.
The text mimics that of an official communication from these toll agencies, sometimes including a link that looks like it is from the state's toll service.
Related
According to the Federal Bureau of Investigations, the toll phishing scam first became prevalent early last year. More than 60,000 complaints were filed with the Internet Crime Complaint Center in 2024.
"Smishing scams are successful because people tend to trust text messages more than emails, often responding quickly to them without fully considering the content, especially when the message appears to be from a trusted source like a bank or delivery company, making it easy for attackers to trick users into clicking on malicious links or sharing sensitive information," the FBI press office told UPI in an email.
The FBI encourages people who have received scam text messages to report them to the Internet Crime Complaint Center and submit the phone number that the text message came from. They should also check directly with their state's toll agency for an amount due, contact the toll agency's customer service and delete the smishing texts.
Joelle McGinnis, press secretary for the Illinois Tollway, echoed the advice of the FBI. She told UPI the Illinois Tollway suggests customers to disregard these texts and report them.
Charles Cyrill, communications director for the Ohio Infrastructure and Turnpike Commission, told UPI that reports of the scam surged in the first week of March. The commission published a news release and video to educate Ohioans about the scam referred to as "smishing."
"The targeted phone numbers appear to be chosen at random and are not uniquely associated with an account or usage of toll roads," a press release from Ohio Turnpike said. "Some customers have also reported receiving emails through phishing scams."
Cyrill said his organization is working with other toll agencies across the country to raise awareness about the tollway scam.
The Better Business Bureau has received more than 800 reports of text messages posing as toll-collection services, according to Melanie McGovern, director of public relations. The service most frequently spoofed has been the Florida Turnpike's Sunpass.
"It's a phishing scam that is trying to capitalize on any confusion that could arise from the new technology for tolls on interstates/highways in the U.S.," McGovern told UPI. "It's important to note that a state's Department of Transportation or toll authority will never provide or ask for personal information by email or text."
Andrew Appe, a computer science professor at Princeton University whose research focuses on computer security, software verification and programming language, told UPI he has also received smishing texts.
"I was fooled for the first minute until I looked more closely at the URL that the text was leading me to," Appel said.
It is not completely clear how scammers are choosing their victims. Appel theorizes that license plates can be connected to contact information. But as the Ohio Infrastructure and Turnpike Commission highlights, not all who have received the texts have used toll roads.
While the text messages solicit money by claiming there are unpaid tolls, the ultimate goal is to access a victim's sensitive personal information and data.
Clicking the links in these text messages or other, similar phishing emails, can give scammers the ability to install ransomware on devices or spyware to track online activity. This puts bank account information, PIN numbers, passwords and payment methods all at risk.
Scammers can then use this access and information to take out loans, transfer money and execute other fraudulent transactions.
"Be cautious about clicking links in text messages, even if they appear to be from a trusted source. Remember that companies generally don't contact you to ask for your username or password," the FBI press office said. " Don't click on anything in an unsolicited email or text message. Look up the company's phone number on your own (don't use the one a potential scammer is providing), and call the company to ask if the request is legitimate. Be careful what you download. Never open an email attachment from someone you don't know."
