Toll road scam

[DoBW]

"Researchers say the surge in SMS spam coincides with new features added to a popular commercial phishing kit sold in China that makes it simple to set up convincing lures spoofing toll road operators in multiple U.S. states."

https://krebsonsecurity.com/2025/01/chinese-innovations-spawn-wave-of-toll-phishing-via-sms/

[yagotme]

1. Got an e-mail awhile back stating I owed tolls from several months back.

Put a computer in charge of something, it will eventually be hacked. Tolls were paid in a timely manner, so I knew this was a scam.

[maveric]

5. Got one of those too.

Scammers.

[EYESORE 9001]

2. I got an SMS message like that recently

I just drop-kicked it into the spam bucket and went on about business, but it’s surprising to see that it’s so prevalent as to prompt a news article.

[Think. Again.]

3. Perhaps DU should have a forum dedicated to the latest scam...

I'm serious..

It seems everyday there's a new scam of some kind that we need to be made aware of.

[keithbvadu2]

4. Good suggestion.

[OAITW r.2.0]

6. Agreed

[Hugin]

7. There seems to be a scam via docusign - paypal going out now as well.

I've blocked two already today.

Interestingly, they have South African IPs.

The diploma mills are back on teevee... yadda yadda... It's scam city for the foreseeable future.

[DoBW]

8. how does this one work? ... email?

[Hugin]

9. Yes.

It's an email that is made to look like a docusign transaction via paypal. Usually, for crypto.

When I dissected the email in my non-Microsoft non-Apple non-ASCII UNIX isolation machine is where I found the more detailed information about IPs and other incriminating facts. (WARNING: Please, don't try this at home. I'm a very practiced hand.)

Advice for laymen/laywomen on how to identify these types of scams:

1. ALWAYS check the real text of an incoming email address not the "CONTACT" (like "BOB SMITH" ). Look at the email address via an info function. A real email address typically looks like "[e-mail]". If the email looks to not be from somewhere you have business with or it's not in any way associated with the topic or business of the content of the email. It's very likely fraudulent.

2. For a business or notification email. Don't click on a link in the email! Go to the website or app and log in to view if you have pending transactions there.