By now, you’ve probably received an out-of-nowhere text message from an unknown contact citing a pressing need to pay an outstanding traffic toll, perhaps from a state you’ve never visited.
The widespread scamming attempt has caught the attention of the Virginia Department of Motor Vehicles and the Better Business Bureau, among other reputable agencies, with both making a clear announcement: Don’t click the link.
“The DMV will never send you text messages about toll bills,” Virginia DMV Commissioner Gerald Lackey said. “We urge our customers to be vigilant and avoid sending your personal information via text.”
To learn more about this scam – and the additional measures you can take to protect yourself – we checked in with University of Virginia’s Chris Mauer, a cybersecurity expert and associate professor at the McIntire School of Commerce.
Chris Maurer has extensive experience in cybersecurity-related fields, including risk management, vulnerability assessment, security awareness and training, business continuity planning and IT governance. (Contributed photo)
Q. What is a scammer’s intention with these texts?
A. These types of phishing campaigns can result in two potential payoffs for scammers. The first, and obvious one, is money. Attackers hope that some victims click through the link and authorize a payment for the “unpaid toll,” but that money goes straight to the scammer’s bank account.
The second potential benefit to scammers is gathering sensitive personal information. While a person may hesitate to enter their credit card number and pay for a toll, they may fall victim to other requests for personal data. For example, when clicking on the link, you may be asked to enter your driver’s license number, license plate number, and/or home address.
This personal data could then be used in future phishing campaigns or be sold on the dark web.
Q. How effective is this kind of scam?
A. While I haven’t seen data specific to toll scams, the sheer number of these messages certainly signals that people continue to fall for them. The FTC tracks fraud of all types and, in the 2024 data just released, they received 246,784 complaints about text message scams with 11% of those respondents claiming they lost money.
Collectively, it was estimated that $470 million was lost to scammers through text message scams in 2024.
Q. If you receive these texts, what should you do?
A. The best thing to do is to report the message as junk/spam. Both iOS and Android have built-in features that allow you to report the message either when you delete the message or by clicking on the message details.
“Attackers hope that some victims click through the link and authorize a payment for the ‘unpaid toll,’” Maurer says, “but that money goes straight to the scammer’s back account.” (Contributed photo)
Reporting typically blocks that sender from sending additional text messages to you, but that often makes no difference as the scammers use different phone numbers or email addresses each time they conduct a new campaign. Reporting does, however, help your mobile carrier recognize spam/scam messages and helps them improve their algorithms for filtering out these messages before they ever reach your device.
Q. Is there any way to block your numbers so scammers can’t send these messages to you?
A. Unfortunately, not really. In some cases, scammers are using data they have purchased from various databases of personal information disclosed in security breaches. In other cases, they are literally sending messages to every single phone number. Since nearly everyone has some personal data that has been previously disclosed in a data breach, our phone numbers are out there and we will continue to be bothered by these types of scams.
Believe it or not, many unwanted text messages are already being filtered out by mobile carriers, so the best thing to do is to continue to report these messages to help carriers continue to improve their filtering capabilities.
Q. What if you’ve responded to these texts or clicked on the link?
A. There’s unfortunately not much you can do if you have already given personal information or provided payment to a scammer. You can certainly report it to the FTC and/or reach out to your bank or credit card to try to place a stop on the payment, but there is no guarantee that you will get any money back.
Q. How can you tell if it’s a scam or if it’s an actual message from a toll service?
A. One clear giveaway is the source of the message. One of the toll scam text messages I recently received came from an international phone number, which will begin with something other than +1 and will not follow our standard three-digit area code followed by a seven-digit phone number. Obviously, E-ZPass is not operating out of a foreign country.
