"You Owe The Turnpike Money" Scam Text Messages

As mentioned in the article this is happening in a lot of different states.  Florida, Massachusetts, Pennsylvania, and a few others.  The actual article has pictures of the sample text messages.

https://www.wcpo.com/money/consumer/dont-wast ... istic-toll-scam

Ohio Turnpike warns about very realistic toll scam
Claims you must pay toll immediately of face fine

Photo by: WCPO
Fake Ohio Turnpike text message

By: John Matarese
Posted at 11:36 AM, Jul 23, 2024
Drivers across Ohio are checking their texts, looking at their email inboxes and finding a surprising message from what appears to be the Ohio Turnpike Commission.
It claims you owe money (typically $9.75) for unpaid tolls on the highway, which runs east to west in northern Ohio.
Worse, it says if you do not click through and pay the bill immediately with a credit card, you will face "additional charges of $97.50."
T. Wright of Ross, Ohio, reached out to WCPO, saying "I have never driven on the Ohio Turnpike as far as I know, what should I do?"
The answer, according to the Turnpike Commission, is to simply delete the message.
It is a very convincing scam, and many people are falling for it.
But the Turnpike Commission says don't click through, and do not enter a credit card or other personal information.
Latest version of a nationwide scam
The message is the latest version of a nationwide ruse, that has has targeted drivers with phony messages about other toll agencies.
As we reported back in June, many of the texts claim to be from Florida's SunPass and the east coast's EZ Pass system.
Since early March, the FBI's Internet Crime Complaint Center has received more than 2,000 complaints about fake texts from senders claiming to be a toll collection service.
The toll program out of Florida, SunPass, has also warned customers about the phishing scam, saying in an email: “Please note that SunPass does not ask customers via text to make a payment or take immediate action on their account.”
Melanie McGovern of the Better Business Bureau says the best thing you can do is to close out the text and put down your phone.
“Maybe go over to a computer. Look at the state or the regional toll agency's website to see if there are phishing scams going on or if you do owe a toll, how you can pay,” she said.
Then, McGovern said to block the number and delete the message.
So check it carefully, so you don’t waste your money.
_____________________
"Don't Waste Your Money" is a registered trademark of Scripps Media, Inc. ("Scripps").

I wonder if this has been much of a money maker for the scammers.  The FTC put out a notice about it back in May and the BBB in April.
https://consumer.ftc.gov/consumer-alerts/2024 ... s-probably-scam
https://www.bbb.org/article/news-releases/302 ... xt-message-scam
Did you come across any information on how many people fell for this?  Would be interesting to know.

One person is too many.

I second  that, Nim.

This type of scam has been around for a long time and it doesn't have to be very realistic to work. There were even FAX versions in the 90's and 2000's.

Wow, I missed that... must have been successful for the scammers to resurrect it.  Thanks B.

I won't doubt it's a rehash in a new costume, as so many fraud schemes are. The new(er) distinction is the speed of deployment and adaptation, and the springboards set for second level threats of personal data plunder, ID theft, and maybe episodic "jail for debt" premises.

This must be a timely warning, given what I saw one night last week, a flurry of similar complaints across several phone number threads. The ambush billing stories were consistent: Pay this nuisance amount now to avoid paying five or ten times as much later.

Reader comments under the FTC advisory suggest an indiscriminate heavy spray of fraud messages. Many recipients are accused of toll debt from states without highway or bridge tolls. Others claim perfect alibis such as not holding a driver's license, being too disabled to drive, not living or traveling anywhere near the alleged offense state, and the like. So we have a scam playing the margins, running on the minority of recipients who are easiest to convince.

Florida AG Moody got busy in early May yanking the plug from ten copycats of the SunPass website, all of them simply tacking an extra word to "SunPass" in their domain names, i.e.: "sunpass-florida", "tolls-sunpass". Her team has racked up another ten kills as of two weeks ago.

Three months ago, the FBI's IC3 issued its alert in response to "over 2,000 complaints reporting smishing texts representing road toll collection service from at least three states". A week later, Recorded Future News did a nice job of rooting between press releases.

    Researchers from cybersecurity firm DomainTools ... have found nearly 30 newly created domains related to tolls, 15 of which have a “high chance of being weaponized for phishing, malware, or spam.” .... the campaign likely started in early to mid February with the threat actors representing themselves as a toll collection authority for the State of New York.

I suppose New York was an incubator for the scam gang, as about a month later the bogus debt notices started invoking the New Jersey Turnpike and soon added more state names and authorities. The spam spray to my first view is reckless, but DomainTools discovered one limiter:

    ... the threat actor appears to be using a browser filter and phishing page that only loads for mobile browsers .... DomainTools shared screenshots showing that all the sites are directing victims to make payment or collect information that would facilitate a future payment. Many of the websites also only allow mobile traffic ...

There's a chin-stroker for you. Maybe the plan hopes to catch the most distracted victim, dashing between errands while failing to observe strict security hygiene. It's also playing on faulty human memory, as people who travel frequently by road are doubtlessly more exposed to toll billing anomalies, which might take years to limp their way through backlogged enforcement systems.


Smishing Scam Regarding Debt for Road Toll Services - FBI alert, 12 Apr 2024
Researchers find dozens of fake E-ZPass toll websites after FBI warning - Recorded Future News, 19 Apr 2024
AG Moody Shuts Down Fake Websites Scamming SunPass Users - Florida AG press release, 09 May 2024

Even low yield scams can make a scammer wealthy. Steal a dollar from a million people and you can become a millionaire.

Thumbs up for Florida AG Moody.  Hopefully the AGs in other States that have tool road systems will be as aggressive at stomping down these scammers.

Good point. I'm sure that's their "business model."  I remember working for Kings Dept Store when I was in high school (long long ago, in a galaxy far, far away) and the manager had us mark down all these ugly pencil boxes from $3 to $.50.  They hadn't moved during "back to school" season but sold out in a week at the low price.  Manager said, "you can sell anything if people think it's a bargain."

Staples has found that it can sell me anything slashed to fifty cents and placed on the back Clearance wall, on the marginal chance I could someday use the dingus. My personal long record is eight years between purchase and practical application. Greatest score was three nice backpacks for $1.50. They went to work right away, I think in Obama's first term, and have not quite worn out.

Nimrod got me wondering why no one has sent the exterminator after fake E-ZPass domains. SunPass has a five-state footprint and a couple toes in Texas, while its HQ is right in Ashley Moody's backyard, which made the cleanup easier if locale matters. E-ZPass has presence in forty percent of the States, and its Interagency Group answers to a Delaware HQ. I don't see this issue on the radar for AG Kathy Jennings.

Maybe it would need coordination with other Northeast states. Else, not enough wheels have squeaked. Moody's motivation was in her own May press release, citing Florida as "home to the most toll roads of any state in the nation — more than 700 miles".

Meantime, I don't know what's keeping either "Pass" group from running trademark defense against the frauds, the way Microsoft did 9.5 years ago in first combat with hordes of fake tech support creeps. It's taking longer than I have to determine if E-ZPass is private or governmental-ish.

Beats me why the real E-ZPass and SunPass won't use the "dot-gov" Top Level Domain to help differentiate from doppelgangers. Even better, it may be helpful if domain registrars could offer a sort of exclusive right to names of governmental offices and programs, without forcing the purchase and shelving of numerous domains. Once the legitimate registration is set, all attempts by outsiders to register endless appended variations of the same character string are rejected at the front door. Naturally you want to carefully vet the sole qualified registrant to prevent a quite destructive cyber-squat. This scheme also does not prevent alternate spellings, out of deference to free speech principles, but spoofs would be much simpler to detect. (i.e.: "sunpa5s", "sun-pass", "e-z-pass", "eezeepass")

Filed under "Not Helping" is the lack of consistent domain name formatting among the toll transponder customer service sites. Every state rolls its own, resulting in a pile of variations when I run a simple search on terms like "SunPass bill" and "E-ZPass debt". It's no wonder the fakes work better than they should. If all the true E-ZPass domains read, let's say, "EZPass.StateName.gov", posers could not hide easily among them.

FIled under "Not Helping Either" are the actual toll violation penalties which make the simulated debts more convincing. Toll authorities stack up $20 and $50 and $100 fines, and fines for not paying the fines, and eventually shunt the fatter pigs to known lawbreaking debt collectors. I've skimmed several lawsuits in different states since 2015 which protest the gulf between just enforcement and unjust enrichment. They don't get very far and complainants are not made whole, despite often citing unfair punishments. Four and five-figure totals may accrue in cases of undetected transponder failure, faulty gantry readings, applying the wrong vehicle class, charging the owner who loaned the car to the actual offender, sluggish delivery of violation notices, and sending misaddressed mail for months. Let's not forget the ancillary costs of vehicle impounds and license suspensions.

My loose observation is that a rise in false positives and billing snafus correlates to the tearing up of human-staffed toll booths as gantries convert to fully automated. I further observe how easily transponder owners can be farmed for incorrect charges and nuisance fees, as the burden is dumped on vehicle registrants to first discover the bad billing and then 'prove it dinna happen'.