FBI Warns About New Toll Scam Texts (I Just Received One!)
Credit: SergioVas / Adobe Stock
Toggle Dark Mode
A recent report from cybersecurity company Palo Alto Networks’ Unit 42 warns that a threat actor recently registered over 10,000 domains to impersonate toll and package delivery services.
Unit 42 is a team with the “daily mission to protect the digital world from cyberattacks.” The texts are called “smishing,” which is derived by combining “SMS” (short message service) with “phishing.” Phishing more generally relates to email scams. So far, the new attack is focused on at least ten states and the Canadian province of Ontario.
These texts aim to get the recipients to give up personal and financial information, like credit card numbers or account numbers. Additionally, you could also be a target for identity theft. The FBI issued a public service announcement about this scam in April 2024. If you receive these texts, delete them right away. Here’s what one looks like.
So far, the US states targeted are California, Florida, Illinois, Kansas, Massachusetts, Pennsylvania, New Jersey, New York, Texas, and Virginia. You should stay vigilant even if you don’t live in one of these states. These hackers are counting on you letting your guard down. According to the FBI, they are moving state-to-state.
Again, if you receive a similar text, delete it. If your carrier supports it, you can also choose the “Delete and Report Junk” option on your Apple device. The FBI suggests filing a complaint with the Internet Crime Complaint Center (IC3) and providing the originating phone number and the website listed within the text.
Regardless of what you decide to do, be sure to delete the text and don’t click on any of the links. The FBI encourages recipients to check their account using the toll service’s legitimate website or contact them via their listed support phone number. If you’re among the thousands of victims, double-check to ensure your financial accounts are secure and dispute any unrecognized charges.
Researchers have indicated cybercriminals have largely moved to a “mobile-first” attack strategy. As people spend considerable time on their smartphones, efforts have been focused on exploiting user behavior and mobile-specific features. This same report indicates smaller screens are more vulnerable because they make suspicious URLS harder to detect, verifying and inspecting URLs on smartphones is more difficult than on computers due to the touch-based interface, and because most users inherently trust their phones. Bottom line, no matter how far Apple goes to protect your privacy and security, everyone needs to stay vigilant.
