Community Government Transportation
Many receiving ‘smishing’ scam messages for alleged unpaid tolls
If you receive a text message demanding payment of unpaid tolls, don’t click the link. It’s a scam.
The state Department of Transportation is warning people of a surge in an ongoing “smishing” scheme that recently began including the web address of its Good To Go! portal (mygoodtogo.com) in the fake address.
Scam began last April
“It’s been going pretty consistently since April,” Lauren McLaughlin, a spokeswoman with WSDOT’s tolling division said in a phone interview Monday. “Since the start of this year, scammers have doubled down on the number of texts they’re sending out and the amount of fake websites they’re creating.”
Smishing is a type of phishing attack that uses fake text messages to trick phone users into revealing financial information such as credit or debit cards or bank accounts, according to the FBI. Phishing generally applies to attacks on the internet, email or websites.
Smishing text received by reporter on Sunday.
This reporter got a message on his iPhone Sunday that reads, “WSDOT Good To GO Final Reminder: You have an outstanding toll. Your toll account balance is outstanding. If you fail to pay by March 17, 2025. You will be penalized or subject to legal action. Now Payment: https://mygoodtogo.com-billsgowkx.xin/pay.”
It was purportedly sent by [email protected].
Though the messages are poorly written and the domain .xin instead of .gov is a giveaway, some continue to be fooled.
Now using official name, logos
“They’re using the (Good To Go!) name and sometimes the logos to add legitimacy to these texts,” McLaughlin said. “They try to create a sense of urgency like there will be legal action or a suspended driver’s license.”
Though Apple bans links in iPhone messages received from unknown senders, the scam attempts to bypass that protection by inviting users to reply with “Y” and reopen the text.
Those who click the link are taken to the scammer’s website, which looks convincingly like the real Good To Go! page, McLaughlin said. There they’re asked for a credit card number or bank information. Sometimes they say they reject a certain type of payment and ask for other cards to gain personal information from all of them, McLaughlin said.
Good To Go! won’t send you a text message for unpaid tolls.
Good To Go!’s customer service representatives have been busy with calls from those who have clicked the link and want to know if the text is legitimate, who were alerted by the message and seek to pay by phone or are just checking whether their account is current, McLaughlin said.
Those who have clicked the link or given away their information should immediately report the transaction to their credit card company and bank, she said.
Customers not only ones hit
The scheme is not only targeting Good To Go! customers but tolling agencies nationwide and even those not associated with tolling. A March 13 Associated Press story said the scams are impersonating tolling agencies in at least 10 states. It added that cybersecurity firm Palo Alto Networks said more than 10,000 domains have been registered for the scams.
“It’s affecting not just customers but also people who don’t even live in Washington, people who don’t own cars. It’s hitting everybody,” McLaughlin said. “If you have a phone number, you’re subject to getting one of these texts. I’ve gotten three or four of them myself.”
The transportation department doesn’t know how scammers are getting people’s phone numbers. The FBI and Federal Trade Commission are investigating.
“I wish I had an answer,” McLaughlin said. “Somebody needs to talk to the national level. We’re just as stumped on how they’re getting numbers.”
FBI on the case
The FBI issued a public service announcement about the toll smishing scam on April 12, 2024. There has been no updated guidance.
The agency at the time asked those who received the scam messages to file a complaint with its internet crime complaint center. Include the phone number from where the test originated and the website listed within the text. The FBI suggested that people should also check their account on the toll service’s legitimate website, contact the toll service’s customer service phone number and delete the smishing texts.
You can also report fraud to the Federal Trade Commission by clicking here.
That the FBI and FTC haven’t been able to stop the smishing scams in nearly a year could be attributed to several factors.
Scammers obscure their identities by using disposable phones. They use fake or stolen identities and prepaid or otherwise difficult-to-trace payment methods to register websites. They operate on platforms and services that are difficult to monitor or regulate.
Many scams originate from outside the country, complicating enforcement. The volume of complaints and scammers’ rapidly changing tactics can overwhelm law enforcement agencies. Scammers often ask for payments via untraceable gift cards or cryptocurrency.