Express Toll Road Text Scams Surge Nationwide (Warning)

In recent months, a sophisticated “smishing” scam targeting drivers with fake toll collection texts has swept across the United States, prompting warnings from state officials and transportation authorities. The scam, which impersonates legitimate toll collection agencies like Express Toll, attempts to trick recipients into revealing sensitive financial information or downloading malware. As cybersecurity firm Palo Alto Networks reports, a threat actor has registered over 10,000 domains for these scams, affecting at least 10 U.S. states and Ontario, Canada.

The Overview of the Express Toll Smishing Scam

These fraudulent messages typically claim the recipient has an unpaid toll and will face penalties if immediate payment isn’t made. The Colorado Department of Transportation (CDOT) has explicitly stated that legitimate Colorado Express Lane and Express Toll fees are never collected via text message, instead being billed directly through ExpressToll accounts.

The scam operates through a technique known as “smishing” – a combination of SMS (Short Message Service) and phishing. According to the FBI, smishing is a social engineering attack using fake text messages to deceive people into downloading malicious software, sharing sensitive personal or financial information, or sending money to cybercriminals.

The E-470 Public Highway Authority, which operates Express Toll in Colorado, has issued an urgent warning on its website: “Express Toll does not send billing or payment requests via text message.” This official statement confirms that any text message claiming to be from ExpressToll and requesting payment should be considered fraudulent.

How Scammers Trap Unsuspecting Victims

The success of these scams relies on creating a sense of urgency and fear. Victims receive texts claiming they have unpaid tolls that require immediate attention to avoid serious consequences. The messages often threaten fines, suspended driving privileges, or other penalties if payment isn’t made quickly.

Louisiana Attorney General Liz Murrill, who personally received one of these scam texts purporting to be from the statewide GeauxPass toll system, warned citizens via Facebook: “It is a SCAM. If you ever receive a text that looks suspicious, be sure to never click on it. You don’t want your private information stolen by scammers.”

These scammers are particularly cunning in their approach:

1. Impersonating legitimate agencies: The texts appear to come from official toll collection services like Express Toll, E-ZPass, or SunPass, using similar language and sometimes even logos to appear legitimate.
2. Creating urgency: Messages typically claim immediate action is required to avoid penalties.
3. Bypassing security measures: On iPhones, which block links from unknown senders, scammers invite users to reply with “Y” to reopen the conversation and then send malicious links.
4. Widening their net: Even residents of states without toll roads, like Vermont, are receiving these messages, indicating the scammers are casting a wide net rather than targeting specific toll road users.

Red Flags: How to Identify Fake Toll Collection Messages

Knowing the warning signs can help you quickly identify these fraudulent messages. Key red flags include:

• Requests for immediate payment: Legitimate toll authorities typically send multiple notices through official channels before taking punitive action.
• Threatening language: Messages that threaten immediate fines, legal action, or suspension of driving privileges are likely fraudulent.
• Suspicious links: Links that don’t clearly lead to official government or toll authority websites (e.g., expresstoll.com) should be treated with extreme caution.
• Unusual payment methods: Requests for payment via gift cards, wire transfers, cryptocurrency, or unfamiliar payment platforms are almost certainly scams.
• Grammar and spelling errors: While not always present, many scam messages contain spelling mistakes, grammatical errors, or awkward phrasing.
• Requests to respond to the text: Legitimate toll authorities typically direct you to their official website rather than asking you to respond directly to the text.
• Toll notices for states you haven’t visited: If you receive a toll notice from a state you haven’t recently driven in, it’s likely fraudulent.

What to Do If You Receive a Fake Express Toll Text Message

If you receive a suspicious text claiming to be from Express Toll or another toll authority, the E-470 Public Highway Authority and the FBI recommend the following steps:

1. Do NOT click any links in the message, as they may contain malware or lead to fraudulent websites designed to steal your information.
2. Do NOT respond to the message, even with a simple “STOP” or “NO,” as this confirms to scammers that your number is active.
3. Delete the message immediately after documenting it if you plan to report it.
4. File a complaint with the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. Include the phone number that sent the text and any website listed in the message.
5. Check your account using the toll service’s legitimate website. For Colorado residents, that’s expresstoll.com.
6. Contact the toll service’s official customer service number if you’re concerned about unpaid tolls. In Colorado, the Express Toll Service Center can be reached at 303-537-3470 or 888-946-3470 (for out-of-area calls).

The Pueblo Police Department also advises citizens to “Stay vigilant and trust your gut: if something seems suspicious about a text or call, trust your instincts – don’t share personal information or click any links!”

How to Protect Yourself from Toll-Related Scams

Beyond recognizing and properly handling suspicious messages, there are several proactive steps you can take to protect yourself from toll-related scams:

• Verify account status directly: Regularly check your toll account through official websites or apps, accessing them by typing the URL directly into your browser rather than clicking links from texts or emails.
• Register for official communications: Many toll authorities allow you to register for official email notifications about your account, making it easier to distinguish legitimate communications from scams.
• Use multi-factor authentication: When available, enable multi-factor authentication on your toll account to add an extra layer of security.
• Keep your toll transponder account information current: Ensure your license plate, credit card, and contact information are up to date to avoid legitimate notifications about account issues.
• Be skeptical of all unexpected texts about tolls: Adopt a default position of skepticism for any unexpected communication about tolls, even if it appears to come from a legitimate source.
• Consider using a credit card rather than a debit card for toll accounts, as credit cards typically offer better fraud protection.

What to Do If You’ve Fallen Victim to the Scam

If you’ve already clicked on links in suspicious messages or provided personal or financial information, taking immediate action can help mitigate potential damage:

1. Change passwords immediately for any accounts that may have been compromised, especially your toll account, email, and financial accounts.
2. Contact your financial institutions to report potential fraud and request new cards if you provided credit or debit card information.
3. Place a fraud alert on your credit reports by contacting one of the three major credit bureaus (Equifax, Experian, or TransUnion). The bureau you contact will inform the other two.
4. Monitor your accounts closely for unauthorized transactions and report any suspicious activity immediately.
5. Consider placing a credit freeze, which prevents new credit accounts from being opened in your name without your explicit permission.
6. Report the scam to the Federal Trade Commission (FTC) at ReportFraud.ftc.gov.
7. Document everything related to the scam, including screenshots of messages, records of any money lost, and reports filed.

Official Statements and Resources

Transportation and law enforcement authorities across the country have issued warnings about these scams. The Colorado Department of Transportation stated unequivocally on January 29 that “All Colorado Express Lane and Express Toll fees will be billed and paid directly through your Express Toll account and never over a text message.”

The E-470 Public Highway Authority’s website prominently displays a “NATIONAL ALERT: TEXT & EMAIL SCAM WARNING” in both English and Spanish, emphasizing that Express Toll never sends billing or payment requests via text message.

For those seeking official information or assistance with potential scams, the following resources are available:

• FBI Internet Crime Complaint Center: ic3.gov
• Express Toll Service Center: 303-537-3470 or 888-946-3470
• Federal Trade Commission: ReportFraud.ftc.gov
• Official Express Toll website: expresstoll.com

As these scams continue to evolve, staying informed and vigilant remains the best defense. By understanding how these scams work, recognizing the warning signs, and knowing how to respond, drivers can protect themselves from becoming victims of toll-related fraud. Remember: legitimate toll authorities will never request payment via text message, and when in doubt, contact the toll authority directly using their official website or phone number.