As a highway toll user, you may have gotten a text message saying you have an unpaid toll, but chances are, it’s a scam. Like many other systems, highway tolls have gone digital, making it easier for users to pay online but also opening the door for scammers. In 2024, the FBI’s Internet Crime Complaint Center (IC3) received over 59,000 complaints about toll scams, leading to more than $129,000 in reported losses in that year [1]. Disguised as official messages, scammers send texts over the phone or email to trick users into paying fake toll fees or stealing their data.
Let’s explain how this new scam works, the warning signs, and how to avoid it.
What Is the Highway Road Toll Scam?
The highway road toll scam is a phishing scam that uses fake SMS messages or emails claiming you owe unpaid toll fees. These messages often urge you to pay through a malicious link, warning that you’ll be fined or penalized if you don’t. The link provided within the text is created to impersonate a toll service name to look more legitimate.
The text message usually looks something like this (Figure 1):
Figure 1: An example of a highway toll scam phone message
Or it can be an email (Figure 2):
Figure 2: Example of a toll scam phishing email
Both the phone text and the email are written in a way that feels legit — you might not even question it at first glance.
Like any classic phishing attack, once you click the link, either malware will be installed on your phone or you’ll be taken to a fake website designed to steal your personal and credit card information.
Red Flags to Watch For
Look out for these signs to detect a toll scam [2][3] :
- Getting a Fee Message of Tolls you Did Not Use: The toll roads do not send text messages to non-account holders.
- Texts Full of Grammar Mistakes: Keep an eye out for spelling or grammar errors in the message. Although this check is not as effective as before because nowadays scammers use Generative AI tools, like ChatGPT, to remove all language-related errors in their phishing text/email.
- Strange URLs: The link might look close to the real toll agency site, but it’ll usually have odd characters, hyphens, or extra domains (e.g., erkrivema.com-ghyopm.top instead of erkrivema.com ). See figure 3 below:
- Unusual Instructions to Open the Link: When the message tells you to reply, exit the message, and then reopen it to activate a link or to manually copy/paste a link, it is suspicious.
- Urgency: If the message threatens “excessive late fees” or “legal action,” be cautious. Real toll agencies don’t pressure people like this through text messages.
- Generic or Overly Polite Language: Messages that say things like “wish you a pleasant holiday” or overly formal language can feel off, especially in a payment request.
How to Protect Yourself from Highway Toll Scams
- Check your toll account directly: you got a toll fee message on your phone! Before doing anything, go to the official toll service website or app to check if you actually owe anything. If you are certain that you didn’t drive on any toll road or you never do that, then it is likely a scam.
- Don’t click any links: Never click on links or respond to unexpected texts — scammers count on you reacting quickly. Take a moment to verify first.
- Use two-factor authentication: This adds a layer of security to your bank and toll accounts.
If you suspect you have fallen victim to this scam:
- Contact your bank immediately and block your credit card
- Run an antivirus on your affected device
- Report the scam to your toll authority and local fraud reporting services
- Change your toll account password, and update any other accounts where you’ve used the same password.
- After reporting, delete the text to avoid accidentally clicking it later [4][5].
And don’t forget to share this with your elderly relatives who might fall victim to these kinds of scams!
Protect your online presence
As systems go digital, scammers are adapting fast — but so can we.
Scammers are no longer sending just fake emails and text messages on your phone, they are now using social media for identity theft and stealing people’s money and personal information by sending you a fake text impersonating a company to ask you for money or personal data.
You can outsmart them by protecting your social media profiles with Eydle! Our AI-powered tool scans your business’s social media profiles, DMs, and comments and detects phishing attempts before they can harm your business or customers.
Learn more about how Eydle can protect your business at www.eydle.com or reach out to us at [email protected].
