The FBI has warned about a rising scam spreading across the United States where cybercriminals are targeting people through fake text messages, known as “smishing,” to steal personal information or trick users into clicking malicious links.
A new report from Palo Alto Networks’ Unit 42 highlights a rising scam tricking people into sharing personal and financial details, including credit or debit card information.
Hackers have set up over 10,000 websites to launch a new wave of attacks. The FBI advises iPhone and Android users to delete any suspicious text messages immediately to stay safe, Forbes reported.
The toll scam has been making news frequently, with reports appearing almost every week in different states. The FTC warns that scammers not only try to steal money but can also access personal information and commit identity theft if victims click the fake links.
Initially, the scam targeted toll payments with fake state-specific links, but now, scammers are also pretending to be delivery services. These scam texts follow the same pattern.
They claim the recipient has an unpaid bill that needs immediate payment to avoid extra charges. The message includes a payment link, but since iMessage blocks such links, scammers instruct users to reply or manually enter the link in Safari to complete the payment.
The FBI has shared simple steps for anyone affected by these scams:
- Report the scam to the Internet Crime Complaint Center (IC3) at www.ic3.gov. Include the scammer’s phone number and the website mentioned in the text.
- Visit the official toll service website to check your account.
- Call customer support at the toll-free service for verification.
- Delete any smishing texts received.
- If someone clicked the link or shared information, they should take steps to secure their personal and financial details and report any suspicious charges.
Different local groups are running the toll scam, but it appears to use tools created by Chinese cybercriminals. The fake websites identified by Unit 42 all use the. XIN domain, which is linked to China.
These scam websites are designed to look real and trick people into clicking on them. Some examples of these fake domains include:
- dhl.com-new[.]xin
- driveks.com-jds[.]xin
- ezdrive.com-2h98[.]xin
- ezdrivema.com-citations-etc[.]xin
- ezdrivema.com-securetta[.]xin
- e-zpassiag.com-courtfees[.]xin
- e-zpassny.com-ticketd[.]xin
- fedex.com-fedexl[.]xin
- getipass.com-tickeuz[.]xin
- sunpass.com-ticketap[.]xin
- thetollroads.com-fastrakeu[.]xin
- usps.com-tracking-helpsomg[.]xin
This is not a complete list, but it can help identify threats. No U.S. toll service or major delivery company will redirect users to a Chinese domain, even if “.COM” appears in the link. The FBI warns never to click links in texts, even if they look legitimate.
Instead, users should visit the official website or call customer service to verify any claims.
