{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2024-unpaid-toll-smishing-wave-sweeps-us-states-fbi-logs-2-000-reports-in-wee"},"incident":{"title":"Unpaid toll smishing wave sweeps US states, FBI logs 2,000 reports in weeks","date":"2024-04-12","date_precision":"day","victim_org":"US drivers and toll customers (multi-victim campaign)","sector":"Transportation & Logistics","country":"United States","primary_vector":"Smishing (SMS)","secondary_vectors":["Credential Phishing Portal"],"ai_involvement":"Unknown","ai_notes":"The IC3 alert does not attribute the campaign to AI tooling.","outcomes":["Identity Theft","Wire Fraud / Financial Loss","Credential Theft"],"loss_usd":null,"loss_note":"IC3 did not publish an aggregate loss figure for the toll smishing campaign.","records_affected":2000,"threat_actor":null,"summary":"On 12 April 2024 the FBI's Internet Crime Complaint Center issued an alert about a nationwide smishing campaign impersonating state toll services. IC3 had received more than 2,000 complaints since early March 2024 referencing toll collection texts from at least three states. The messages used consistent language and amounts across states, and pointed to fake websites impersonating legitimate tolling agencies with phone numbers varied by state.","how_it_worked":"Recipients received a text stating that an outstanding toll amount of $12.51 had been noticed on their record and that visiting a link would settle the balance and avoid a $50 late fee. The lever is a small, plausible, low-stakes debt: the sum is too trivial to warrant checking with the tolling authority, and the late fee creates just enough urgency to act immediately. The linked site cloned the state tolling agency's branding and collected card details and personal information for payment fraud and identity theft. Attackers rotated the impersonated agency by recipient area code, so the message named a tolling authority the target plausibly uses.","lessons":"Never transact from a link in an unsolicited text; navigate to the tolling agency independently. Carrier-level detection of newly registered look-alike tolling domains is the scalable control.","confidence":"Confirmed","sources":[{"title":"Smishing Scam Regarding Debt for Road Toll Services","url":"https://www.ic3.gov/PSA/2024/PSA240412","publisher":"FBI Internet Crime Complaint Center"}],"entry_type":"campaign","slug":"2024-unpaid-toll-smishing-wave-sweeps-us-states-fbi-logs-2-000-reports-in-wee","year":2024,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2024-unpaid-toll-smishing-wave-sweeps-us-states-fbi-logs-2-000-reports-in-wee"}}