In today's digital age, staying vigilant about cybersecurity is more crucial than ever.

A new wave of cyber threats is targeting Americans, prompting the FBI to issue an urgent warning about a deceptive text message scam. Are you at risk?


The FBI first raised concerns in April, cautioning people to delete any text messages claiming they have unpaid tolls. These messages are a form of phishing, specifically known as "smishing," which tricks recipients into clicking malicious links.

By January 17, the Federal Trade Commission (FTC) reinforced the warning, reminding Americans that these scams aim to steal money and sensitive personal data.

“Don’t click on any links in, or respond to, unexpected texts. Scammers want you to react quickly, but it’s best to stop and check it out,” the FTC advised.



Reports indicate that these fraudulent messages have been circulating in multiple states, including Massachusetts, California, North and South Carolina, Illinois, Colorado, and Florida. The issue has become so widespread that local governments and transportation agencies are issuing their own warnings.

For example:

• The City of Great Falls, Montana, alerted residents via social media that the scam was not coming from their local government.
• The Massachusetts Department of Transportation emphasized that EZDriveMA, the state’s toll collection system, never requests payments via text.
• The Oklahoma Turnpike Authority advised drivers to ignore messages that contain incorrect URLs or unfamiliar language.

Many recipients quickly identified the scam when they received toll payment requests despite living in areas without toll roads. According to Hertz, 18 states—including Arizona, Idaho, Montana, Wisconsin, and Tennessee—don’t have toll roads, making the scam messages even more suspicious.

A common red flag in these fraudulent texts is odd formatting, such as the use of handshake emojis between demands for payment. Some victims even received messages despite not owning a vehicle.


While the exact source of the scam remains unclear, cybersecurity expert Chris Krebs suspects that at least one Chinese cybercriminal group is responsible. His findings align with research from Ford Merrill of SecAlliance, a firm that protects critical infrastructure and financial institutions.

Merrill’s research suggests that after the New Year, the number of SMS phishing attacks impersonating toll operators spiked. This coincided with the release of new phishing kits developed by Chinese cybercriminal groups, allowing scammers to create fake toll payment pages.



These phishing kits enable criminals to steal payment details and add them to mobile wallets, which they then use to make purchases or launder money through shell companies.

If you receive a suspicious toll payment request, follow these steps:

• Do not click any links in the text message.
• Verify your account by visiting your toll provider’s official website or contacting their customer service.
• Report the scam to the appropriate authorities, such as the FTC or the FBI’s Internet Crime Complaint Center.

For our members at The GrayVine, it's essential to be aware of these threats and to know how to protect yourselves.

Always be skeptical of unsolicited messages, and remember that legitimate organizations will not ask for sensitive information via text.
As cybercriminals continue to refine their tactics, staying alert and informed is your best defense. If you've encountered similar messages or have tips on how to stay secure online, we'd love to hear from you in the comments below. Together, we can help each other stay one step ahead of cybercriminals.