Scammers have apparently paused their fake toll road scams in order to start up a new campaign: Fake texts from motor vehicle departments. According to a blog post from Malwarebytes, a new phishing campaign has been spreading through several states.
For instance, one of these fake texts, which claimed to be from the Ohio Bureau of Motor Vehicles, was sent to an employee at Malwarebytes Labs. The message itself used the lure of having outstanding traffic tickets as a way to get the recipient to respond.
Like most phishing attacks, it had many of the usual red flags: spelling errors, a sense of urgency that encouraged the target to take action by making a payment using the included link, threats of legal or administrative action and instructions that would circumvent their phone's ability to block spam messages. It was also a group text sent to multiple people and didn’t address the target specifically by name.
Similar text messages have been reported in other states including Ohio, Indiana, Colorado, West Virginia, Hawaii, Arizona and New Hampshire. Clicking on the included link sends potential victims to a mock-up site that looks like a real department of motor vehicles site. It includes a form the victim can fill out to “pay” the supposed fine which actually sends the victim’s personal details and financial information back to the scammers who can then use this info to commit fraud or even identity theft.
How to stay safe from scam texts
Keep in mind the red flags above: A real motor vehicle department is never going to text you with a "pay now or else" style message. They also will not threaten you with actions like prosecution or affecting your credit score. At the same time, you always want to check for spelling errors (in the example, September 10nd or 20025), and if the text includes a code or violation number, Google it to see if it returns a legitimate result. Additionally, if a government agency or department does reach out to you electronically instead of through the mail, a message of this importance will never arrive in a group text.
From there, you also want to make a point to search phone numbers and email addresses to look for associations with scams. Many will have results that show they are in fact fraudulent. When in doubt about a contact or message, go directly to the website of the organization to see if they have messages for you in your account.
Also, as we've said before, never, ever click on links in unsolicited messages and don't reply to them either. If you've made the mistake of clicking on a link or replying to a text, change your passwords for any accounts involved with the message and contact your bank to report the incident and to see about monitoring or freezing your account. You can report cases of identity theft to the FTC at identitytheft.gov as well as contact the FBI’s online division at IC3.gov. Doing so is a great (and helpful) way to prevent others from falling victim to similar scams.
Lastly, you can protect yourself online by making sure you have one of the best antivirus software solutions installed and up-to-date on all your devices (including mobile), and making sure it has features like a VPN, a browser that will alert you to suspicious websites, spam alerts, and identity monitoring or identity theft protection features.
Whether it's a toll road organization or the DMV, nobody likes to get text messages saying they owe the government money which is why this lure has been and remains quite effective. However, now that you know how to spot this type of scam, you're much less likely to fall victim to it yourself but you should also pass this knowledge on to your family and friends to keep them safe too.
Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.
More from Tom's Guide
- This new Android banking trojan can automatically transfer money off your phone to hackers
- Plex users need to change their passwords — there’s been another breach
- Macs under attack from ‘cracked’ apps spreading dangerous info-stealing malware — don’t fall for this
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
