The FBI released a public service announcement warning of an uptick in unpaid road toll SMiShing scams. Since the scams started in early March 2024, over 2,000 complaints have been made to the FBI from at least three states, and it appears to be moving from state to state, including New Jersey, New York, and Pennsylvania. On April 12, the New Jersey Turnpike Authority issued a statement alerting drivers that the scam had begun to target drivers throughout the state.

The fraudulent SMS text messages contain almost identical language, including a similar amount owed for the “outstanding toll amount.” However, threat actors impersonate the target state’s toll service name and change the sender’s phone number and link in the message depending on the state. This social engineering attack appears to be an attempt to trick users into providing personal and financial information.

Recommendations

• Avoid clicking links, responding to, or otherwise acting on unsolicited text messages.
• Confirm requests from senders via contact information obtained from verified and
  official sources.
• Type official website URLs into browsers manually.
• Report SMiShing to the FTC, FBI’s IC3, and NJCCIC, and forward the message to 7726
  (SPAM).

For any further questions, contact us here at Cyber Command.