- The American Smiming scam says that unpaid toll service fees are due
- SMS messages include a false link to make an online payment
- Cybercriminals use more than 10,000 areas to deceive receivers
A widespread SMS scam targets thousands of smartphone users in the United States. The fraudsters send false texts requiring the payment of unpaid road tolls. Their objective is not only to sneer innocent beneficiaries of their money, but also of their personal and financial information.
The reports of the Shumshes swindle surfaced for the first time last year. In April 2024, the Center for Crime Complaints on the Internet of the FBI (IC3) published an opinion on false text messages from the toll service, after receiving more than 2,000 complaints from American citizens.
Since then, the scheme scale seems to have increased. Cities in several American states have now issued warnings, including Boston, Denver and San Francisco. McAfee also highlighted the cities most affected by the program: the first three are Dallas, Atlanta and Los Angeles.
How does Smiming scam work
Based on the screenshots we have seen, text messages in the toll scam all seem to follow a similar structure. Each SMS claims to come from a legitimate toll service and indicates that there are unpaid costs. He then asks the beneficiary to pay for the pending in suspense within a defined time to avoid delay costs and a reference to the DMV. An URL is then provided, which directs the uses to a false payment page.
This page is designed to convincingly resemble a legitimate website for the toll service. It will often include a logo, a business name and a street address. It will also indicate the supposed time and date of unpaid costs.
A threat actor taking advantage of the same denomination scheme recorded 10K + domains for various #SMISH scams. They arise as toll services for American states and parcel delivery services. The domain names Racine begin with “com-” as a means of deceiving the victims. More information on pic.twitter.com/7cbkvwywxoMarch 7, 2025
If you click on the payment link, the website will then request payment information. Sometimes he also requests sensitive personal information, such as your driving license number. If you submit this information, you really give it to fraudsters, by exposing yourself to identity theft.
The scam uses the same tactics as most phishing scams, creating a feeling of urgency by demanding payment in a short period of time. The threat of legal action increases the probability of an emotional reaction, which could lead users to ignore inconsistencies in the SMS page or original related payment.
The scam uses the same tactics as most phishing scams, creating a feeling of urgency by demanding payment in a short period of time.
The reports also suggest that there are variations in the scam. In some cases, it seems that cybercriminals have varied the content of the SMS and payment page to users targeting in specific states. A screenshot that we saw claims to be from New York City. For some recipients, this could make the message more credible than a generic alert.
Recent information from Palo Alto Networks unit report that the crooks have recorded more than 10,000 domain names. Each of them is designed to be ambiguous enough for a relaxed glance so as not to reveal the deception. Not only do new areas suggest that the scam is still underway, but some URLs indicate that it could develop to include false messages from delivery companies – an increasingly common tactic.
Here are some of the areas listed in the opinion:
- DHL.com-New[.]Xin
- Driveks.com-jds[.]Xin
- Ezdrive.com-2h98[.]Xin
- Ezdrivema.com Citations-Etc[.]Xin
- Ezdrivema.com-securetta[.]Xin
- e-zpassiag.com-courtfees[.]Xin
- e-zpassny.com–Tickketd[.]Xin
- Fedex.com-fedexl[.]Xin
- Getipass.com-Mickeuz[.]Xin
- Sunpass.com-ticketap[.]Xin
- Thetollroads.com-fastrakeu[.]Xin
- USPS.com Tracking-helpsomg[.]Xin
How to stay safe
As with any shishing or phishing scam, the best way to stay safe is to practice caution. If you receive an unexpected SMS on unpaid toll costs, there is a good chance that it is a scam. Take a break before acting on message information and click on any link.
Pay attention to the details of the message. The texts of the scam will often include grammatical errors or formatting inconsistencies, such as the placement of the puncture. A more in -depth examination of the URL often reveals that it is also illegitimate.
If in doubt, contact the authentic toll service in question. Never click on the link in SMS. Instead, find the real website or the service contact number using a confidence search engine and contribute to clarification.
The scam is now so extensive that the United States Federal Commission has given advice to the same effect, such as the FBI. If you discover a suspicious false or SMS, the instructions of the two agencies are the same: report and delete messages. You can do it on the IC3 website.
