| In April 2024, the NJCCIC reported an uptick in unpaid road toll SMiShing scams. Similar SMiShing scams have resurfaced, as threat actors are impersonating multiple road toll agencies nationwide to target New Jersey residents to collect personal and financial information. Threat actors also target residents in other states, including Massachusetts, Connecticut, California, Maryland, Virginia, and Washington, DC. |
 |
| Threat actors create a sense of urgency by convincing their targets to pay a purported unpaid toll bill of $6.99 to avoid late fees. Other messages contain threats to revoke the target’s driver’s license or take legal action if immediate payment is not made. In the above example, the text message impersonates the legitimate EZDriveMA agency by including a link referencing EZDriveMA. The link is already active; therefore, users are advised not to reply “Y” for yes or follow the further instructions to activate the link. Other examples impersonate the legitimate EZPass and FasTrak agencies by including a link referencing EZPass and The Toll Roads (the company that operates FasTrak), respectively. If the fraudulent link is clicked, unsuspecting victims may be directed to enter their personal and financial information, which is sent to the threat actors in the background to commit further malicious activity. |
| Some reports indicate that threat actors send multiple text messages to their targets. Additionally, the text messages appear to be sent randomly since some targets reported that they do not drive or own a car or have not traveled anywhere in the region, requiring a toll to be paid. Official toll agencies will not send toll bills or requests for payment via text messages. |
| Recommendations |
| Avoid clicking links, responding to, or acting on unsolicited text messages. Confirm requests from senders via contact information obtained from verified and official sources. Check your toll agency’s account by manually typing the official website URL into the browser or contacting the toll agency’s customer service phone number. Report SMiShing to the FTC, FBI’s IC3, and NJCCIC, and forward the message to 7726 (SPAM). |