Drivers across the U.S. are being hit with fraudulent text messages claiming to be from toll operators like E-ZPass. These messages threaten fines for unpaid tolls and aim to steal personal and financial information. Security experts warn that these scams are becoming increasingly sophisticated, driven by new phishing tools.
Recently, the Massachusetts Department of Transportation (MassDOT) issued a warning about a smishing campaign targeting users of its EZDriveMA toll program. Victims who click on the links are prompted to enter credit card details and sometimes verify a one-time password (OTP) via SMS or authentication apps.
Similar scams have been reported in several states, including Florida (SunPass), Texas (North Texas Toll Authority), California, Colorado, Connecticut, Minnesota, and Washington. These phishing attempts often direct victims to fake toll authority websites that only work on mobile devices, making them more convincing.
Toll-related phishing attacks have surged in early 2025, coinciding with updates to phishing kits sold on underground markets. These kits, developed by Chinese cybercriminal groups, include templates designed to mimic toll operators across multiple states.
The scammers’ goal is to steal payment card details, add them to mobile wallets, and make fraudulent purchases or launder money through shell companies. Similar tactics have been used to impersonate shipping companies, tax agencies, and immigration services.
How to Protect Yourself:
- Verify the source: Don’t click on links in unsolicited texts. Visit your toll provider’s official website directly.
- Enable multi-factor authentication (MFA): Add an extra layer of security to your accounts with MFA.
- Monitor your accounts: Regularly check bank and credit card statements for suspicious activity, especially coming from your toll account.
- Report scams: Notify your toll authority and file a report with the Federal Trade Commission (FTC).
As these scams grow more advanced, staying vigilant is crucial. Understanding how they operate can help you protect your personal information and help you avoid becoming a victim.