‘Smishing’ scam texts are still a threat: What to know
An increasingly-reported scam involving fake text messages attempting to collect money from highway tolls and package delivery services is still reaching a countless number of phones.
The FBI and FTC have previously warned of these scams. Here’s what they’ve said.
FBI warning of smishing texts
Whether you’ve driven through a toll recently or not, you may have received a scam text saying you owe money for unpaid tolls.
According to the Federal Trade Commission (FTC), scammers are pretending to be tolling agencies from coast to coast and sending texts demanding money.
What they're saying:
The FTC and FBI said you may get a text message that says you have unpaid tolls and need to pay immediately. The text may show a dollar amount for how much you supposedly owe and include a link that takes you to a page to enter your bank or credit card information.
"Not only is the scammer trying to steal your money, but if you click the link, they could get your personal info (like your driver’s license number) — and even steal your identity," Andrew Rayo, a consumer education specialist at the FTC, said in a blog post.
FILE: Scam text illustration (Credit: Getty Creative)
"The texts claim the recipient owes money for unpaid tolls and contain almost identical language," the FBI said. "The ‘outstanding toll amount’ is similar among the complaints reported to the (FBI Internet Crime Complaint Center)."
The FBI added, "However, the link provided within the text is created to impersonate the state's toll service name, and phone numbers appear to change between states."
The backstory:
The FBI issued an alert last year about the scam, noting how it has received over 2,000 complaints since early March about SMS phishing, or "smishing," in at least three states.
New campaign also poses as package delivery service, cybersecurity company says
A new report, from cybersecurity research company Palo Alto Networks’ Unit 42, said a new campaign "entices users to reveal personal and/or financial information, including credit or debit card and account information."
The original threat focuses on toll scams, with state-specific payment links; the new set of domains adds delivery services into the mix. The company said more than 10,000 domains were registered for ‘smishing.’
The texts impersonate toll services and package delivery services in at least 10 U.S. states and one Canadian province The states include California, Florida, Illinois, Kansas, Massachusetts, Pennsylvania, New Jersey, New York, Texas and Virginia.
"A threat actor leveraging the same naming pattern has registered 10K+ domains for various #smishing scams," Unit 42 wrote on X. "They pose as toll services for US states and package delivery services. Root domain names start with "com-" as a way to trick victims."
They said they would continue to track and attempt to block the campaign.
How to avoid text scams
What you can do:
To avoid a text scam like this, the FTC says not to click on any links in, or respond to, unexpected texts. Scammers want you to react quickly, but it’s best to stop and check it out.
RELATED: Job offers through texts? Be careful, it's likely a scam
If you’re unsure, reach out to the state’s tolling agency using a phone number or website you know is real — not the info from the text.
Report and delete unwanted text messages. Use your phone’s "report junk" option to report unwanted texts to your messaging app or forward them to 7726 (SPAM). Once you’ve checked it out and reported it, delete the text.