Apple and Android Appear Powerless Against Toll Scam Texts

More people than ever are receiving text messages warning them that if they don’t pay their toll bill by a certain date, they could face a fine and lose their driver’s license. These scams are not just more common — they’re also claiming more victims and big phone companies like Apple and Google can’t block them.

According to a Thursday report from CNBC, cybersecurity company Trend Micro has observed a 900% uptick in searches for “toll road scams” in the past three months, indicating that the texts are reaching more people. McAfee research obtained by the outlet found that from early January through the end of February, toll scam texts were four times more prevalent.

Related: 80% of Banks Admitted They Can’t Keep Up With AI Scams Aimed at Draining Personal Accounts

“It is obviously working; they are getting victims to pay it,” Jon Clay, Trend Micro’s vice president of threat intelligence, told CNBC. “This one apparently seems to be going on a lot longer than we normally see these things.”

Though Apple iPhones have a safety measure in place that removes the link from a preliminary text, hackers are finding ways to get around that. Per AP, the scam asks users to reply with “Y” to reopen the text with an active link. Blocking a scam number or reporting it as spam on an Apple or Android phone is a temporary fix because scammers can simply switch numbers and reach out again.

The FBI issued a public service announcement about the scams in April 2024, stating that it had received more than 2,000 complaints in at least three states. It asked anyone who received a scam text to file a complaint with the Internet Crime Complaint Center and delete the text.

The Federal Trade Commission issued a consumer alert article in January about the unpaid toll scam, advising Americans not to react quickly, click on any links, or respond to texts. The Virginia DMV, California Attorney General, and Illinois Tollway also gave separate warnings to consumers about the scams earlier this year.

Related: AI Cloning Hoax Can Copy Your Voice in 3 Seconds—and It’s Emptying Bank Accounts. Here’s How to Protect Yourself.

Clay told CNBC that toll scams are inexpensive and easy to implement, with scammers buying phone numbers and website domains in bulk to send millions of text messages.

The domains can be state-specific, like Georgia’s Peach Pass, Florida’s SunPass, New York’s E-ZPass, or something more generic, like FastTrak. The texts are numerous — threat research firm Censys estimates that over 60,000 domains exist to perpetuate toll schemes.

While the texts seem aimed at collecting money immediately, the real goal is to collect personal information. Access to someone’s identity is the key to broader criminal activity.

According to KP Law, personal information is valuable because criminals can use it to steal identities for financial gain and take over personal accounts. For example, they can use credit card information to make unauthorized purchases or take out loans.

There’s a simple way to deal with the toll scam text: Don’t click on anything, don’t respond at all, and just delete.