FBI Warns of Unpaid Tolls Text Message Scam

The Toll of Urgency: Countering the Rise in Road Toll Smishing

As security awareness professionals, we know that the most effective phishing lures are those that blend seamlessly into an employee’s daily life. Currently, the FBI is warning of a massive smishing campaign that exploits a common, low-friction activity: paying road tolls. Since March 2024, thousands of Americans have been targeted by texts claiming they owe small amounts (often around $12.50) to avoid significant late fees.

This scam is particularly effective because it uses a “low-stakes” financial threat to trigger a “high-urgency” emotional response. By understanding the mechanics of these toll scams, we can better equip our workforces to recognize the pivot from a simple text to a total credential compromise.

Guidance to Encourage in Your Security Training and Awareness Programs

To help your team stay ahead of these mobile-first threats, prioritize these specific defensive strategies in your next awareness update:

• The “Direct-to-Portal” Rule: This is the primary defense against smishing. Instruct employees to never click a link in a text message regarding a bill or fee. Instead, they should navigate directly to the official toll service website (e.g., E-ZPass or a state turnpike portal) or use the official mobile app to check their account status.

• Identify the “Small-Ask” Hook: Scammers use small, believable dollar amounts to lower a victim’s guard. Remind your team that the size of the requested payment is irrelevant—the goal is to capture credit card details and personal information on the fake payment page.

• Bypass the Provided Number: If a text includes a phone number to “call for help,” it is likely a fake support line. Advise employees to look up the organization’s official customer service number independently if they feel the need to speak with a representative.

• The “State-to-State” Warning: Because these scams are moving geographically, encourage employees to be vigilant even if they haven’t traveled recently. Scammers often blast these messages to entire area codes regardless of the recipient’s actual driving history.

• Report to the IC3: Security is a collective effort. Encourage employees to report these texts to the FBI’s Internet Crime Complaint Center (IC3). Reporting the sender’s number and the malicious URL helps law enforcement track and shut down the infrastructure behind the campaign.

By shifting the focus from “email safety” to “mobile safety,” you help your employees protect their personal finances and reinforce the vigilant habits necessary to protect corporate data.

Read the full breakdown of the FBI toll scam warning here: FBI Warns of Unpaid Tolls Text Message Scam