(NEXSTAR) – Drivers should be on the lookout for scam text messages warning of an unpaid road toll bill, according to recent warnings from authorities.
The text messages name the local toll service, such as FasTrak in California, and have a link that takes the victim to a convincingly-duped version of the collection operator’s website.
“The texts claim the recipient owes money for unpaid tolls and contain almost identical language,” according to the FBI. “The ‘outstanding toll amount’ is similar among the complaints reported to the IC3 (FBI Internet Crime Complaint Center). However, the link provided within the text is created to impersonate the state’s toll service name, and phone numbers appear to change between states.”
The FBI told Nexstar that it received more than 60,000 complaints in 2024 from people reporting suspicious messages about unpaid tolls.
The text-based style of the scam has been labeled “smishing,” which combines “SMS” or “short message service” with “phishing,” which usually refers to attacks made via email or websites.
“Smishing scams are successful because people tend to trust text messages more than emails, often responding quickly to them without fully considering the content, especially when the message appears to be from a trusted source like a bank or delivery company, making it easy for attackers to trick users into clicking on malicious links or sharing sensitive information,” according to the FBI.
The flood of attacks has prompted warnings from police and toll authorities across the country in recent weeks. Last Wednesday, Brian Keenan, the police chief in Holyoke, Mass., reminded E-ZPass users that “city, state or federal agencies nor utility companies, police, sheriffs, etc. do not accept payments via gift cards, bitcoin, Venmo or similar online payment services.”
Keenan encouraged residents to delete any such messages and share information about the scam with “older or elderly members of your family as that population is often targeted.”
In California, FastTrak continues to warn customers about the fraud, adding that FasTrak “does not request payment by text with a link to a website.”
The Better Business Bureau (BBB) says they have received a number of complaints about the fake collection attempts, made under the name of various toll services that include the Illinois Tollway, Florida Turnpike (Sunpass), Georgia Peach Pass or EZ Drive MA.
“At first I thought it was legitimate,” said one Massachusetts driver who filed a complaint with the BBB after remembering that autopay was set up and should have covered the toll cost.
What do we know about the scammers?
Roughly a year after the predatory text messages began, investigators and toll collection services are learning more about how the bad actors are operating.
John Goodwin, assistant director of communications with the Metropolitan Transportation Commission in San Francisco, said the smishing campaign may not be confined to the United States.
“The domain registration for the websites that these messages instruct folks to click on, typically, are registered offshore,” Goodwin said. “We’ve traced these to domains registered in Hong Kong, registered in Russia [and] at least one South American country.”
In the San Francisco Bay Area, Goodwin says the messages often come in waves, with the messages changing every six or eight weeks, and target people indiscriminately.
“It concerns people, whether they’re customers or not,” Goodwin said. “Our legitimate customers are understandably upset about this, and those who are not yet FasTrak customers are confused.”
The scam has even caught the attention of the global International Bridge, Tunnel & Turnpike Association (IBTTA), which reported last summer that several states actively shut down illegitimate sites as they were discovered, but admitted that combatting the texts had been challenging.
“The fraudulent messages communicate low toll values owed, combined with the sense of urgency to avoid potentially high fees and risks of vehicle registration or license suspensions,” according to the IBTTA. “The combination often tricks victims into providing details of their personal information.”
What happens if you tried to make a toll payment?
The websites behind the imposter texts can look extremely convincing, so those who click on the link may feel secure enough to provide personal details and payment information.
If you’ve fallen victim to the scam, make sure your personal and financial information is secure. The FBI recommends disputing any unfamiliar charges to your credit card account.
“If you have clicked on any of the links from these texts, bad actors could install ransomware or other programs to spy on your online activity or hold your device hostage by encrypting data and demanding payment to unscramble it,” according to the FBI. “They could also gain access to personal information including passwords, credit card numbers, banking PINs, etc., to take out loans or credit cards or perform other fraudulent financial transactions using your identity.”
For more information on safeguarding your identity or starting the recovery process, see the Federal Trade Commission Identity Theft website.
Avoiding text-based scams
The FBI has the following tips for avoiding smishing attacks:
- Be cautious about clicking links in text messages, even if they appear to be from a trusted source.
- Remember that companies generally don’t contact you to ask for your username or password.
- Don’t click on anything in an unsolicited email or text message. Look up the company’s phone number on your own (don’t use the one a potential scammer is providing), and call the company to ask if the request is legitimate.
- Carefully examine the email address, URL, and spelling used in any correspondence. Scammers use slight differences to trick your eye and gain your trust.
- Be careful what you download. Never open an email attachment from someone you don’t know and be wary of email attachments forwarded to you.
- Set up two-factor (or multi-factor) authentication on any account that allows it, and never disable it.
- Be careful with what information you share online or on social media. By openly sharing things like pet names, schools you attended, family members, and your birthday, you can give a scammer all the information they need to guess your password or answer your security questions.
The FBI asks people who receive unpaid toll smishing texts to report them to the IC3 and include the phone number from where the text originated and the website listed in the text.
“This allows us to track trends and see where there are similarities and differences in what the bad actors are using or how they are contacting their victims,” the FBI told Nexstar.
