THINK YOU OWE A TOLL: DON’T PAY UNTIL YOU READ THIS
posted by
Dima Khrustalov
A SCAM THAT TAKES A “TOLL”
This year, both the California 1 and Florida 2 State Attorney Generals issued scam advisories warning residents about a rise in text-based toll scams.
These scams typically involve fraudulent messages requesting payment for supposed unpaid tolls. These scams are designed to compromise payment card and billing information.
We suspect that some these campaigns may be in part orchestrated by Chinese threat actors. A prominent Chinese-speaking group on Telegram offers various phishing kits targeting US and Canadian toll companies.
The Scam
Example of the scam textThe scam begins with a text message claiming the recipient has outstanding toll charges. The message may often create a false sense of urgency by claiming a deadline to pay outstanding tolls and/or threaten legal action. The recipient is instructed to pay the balance through the link provided, which is a phishing link.
These messages and phishing sites impersonate different tolling agencies across the country such as E-ZPass and Sunpass.
Screenshot of a toll-scam phishing website provided by a scam reporting community
Ultimately, these phishing pages are designed to capture the recipient’s billing address and payment card details.
Screenshot of a toll-scam phishing website provided by a scam reporting community
Any information the victim enters on the phishing site may be harvested by the fraudster(s) to conduct payment card fraud or other illicit activities. These messages and phishing sites impersonate different tolling agencies across the country such as E-ZPass and
BEHIND THE DECEPTION
We suspect that there may be a connection to this campaign orchestrated by Chinese threat actors. We identified a Chinese-language Telegram group with more than 4K subscribers, run by an actor under the Telegram moniker “@wangduoyu0”. Screenshot of Telegram group.
Screenshot of Telegram group phishing offerings.
In this group “@wangduoyu0” offers various phishing kits targeting US and Canadian toll companies.The details collected during our engagement with “@wangduoyu0” suggest that phishing kits offered for sale are specifically designed to be distributed via SMS spam campaigns.
The monthly price for a single toll company phishing page is $288. This monthly price also includes an admin panel of the phishing page. Screenshot of admin panel.
TAKEAWAYS
Awareness of the latest scam tactics is key targeting to understanding how personal information is being compromised
Exposure of the scam, its tactics, and what it’s designed to compromise can aid financial institutions in customer education.
