The texts first started arriving on Eric Moyer’s phone in February.  They warned him that if he didn’t pay his FastTrak lane tolls by February 21, he could face a fine and lose his license.

The Virginia Beach resident did what the majority of people do: ignore them. But there was enough hesitation to at least double-check.

“I knew they were a scam immediately; however, I had to verify my intuition, of course; I accessed my E-ZPass account to ensure, plus I knew that I had not utilized a toll road in recent months,” Moyer said, adding that his wife’s phone also received the same blitz of menacing messages.

But not everyone ignores them, and, unlike Moyer, not everyone has an E-ZPass account to check. Some people do pay, which makes the whole endeavor worthwhile for hackers, and which is why the toll texts keep coming. And coming.

In fact, cybersecurity firm Trend Micro has seen a 900% increase in searches for “toll road scams” in the last three months, meaning, the company says, that these scams are hitting everyone, everywhere, and hard. 

“It is obviously working; they are getting victims to pay it. This one apparently seems to be going on a lot longer than we normally see these things,” said Jon Clay, vice president of threat intelligence at Trend Micro.

In this case, the “they” are likely Chinese criminal gangs working from wherever they can find a foothold, including Southeast Asia, which Clay says Chinese criminal gangs are turning into a hot spot.

“They are basically building big data centers in the jungle,” Clay said, and staffing them with scammers.

Clay also says that absent a big news event that scammers can latch onto, the toll scam fills the void. But he said tax-time scams will soon really ramp up.

What really makes the toll scam effective is that it is cheap and easy for scammers to utilize. They can buy numbers in bulk and send out millions of texts. A handful of people will be persuaded to pay the $3 toll fee to avoid the (fictional) threat of fines or licensing revocation. But Clay says they aren’t just interested in the $3; it’s your personal information that you’ll enter that has far more value.

“Once they have that, they can scam you for other things,” Clay said. 

Aidan Holland, senior security researcher at threat research platform Censys, has been extensively tracking toll scams and agrees that they are likely perpetuated by Chinese criminals overseas. Holland has identified 60,000 domains, which he estimates cost the criminals $90,000 to buy in bulk and use to launch attacks.

“You don’t invest that much unless you are getting some kind of return,” Holland said.

State-run toll systems across the U.S. targeted

The domains use variations of state-run toll systems like Georgia’s Peach Pass, Florida’s Sun Pass, or Texas’s Texas Tag. They also have more domains from generic-sounding toll systems for people who don’t have a specific toll system in their state. He’s traced the domains to Chinese networks, which point to a Chinese origin.

Apple’s iPhones are supposed to have a safety feature that strips the link from the text, but hackers are finding ways to evade that, making it easier to fall for the ruse.

“They are constantly changing tactics,” Holland said.

Apple did not respond to a request for comment.

“Apple doesn’t do anything about it. … Android will add it to their spam list so you won’t get texts from the same number, but then the scammers will just change numbers,” Clay said. “Apple has done a wonderful job of telling everyone their phone is secure, and they are, but not from this kind of attack,” Clay added.

Across the 241 miles of the Ohio Turnpike, the scam first appeared on the state’s radar in April 2024, but it has been ramping up recently, said a spokesman for the Ohio public road system.

“Over the past two weeks, our customer service center has received a record number of calls from customers and mobile device users in area codes across Ohio and elsewhere about the texting scam,” the spokesman said. The good news, he says, is that the calls have been tailing off in recent days, likely because of growing awareness, and he said personally he knows of few who have fallen for the scam.

However, the issue has become acute enough that the Ohio Turnpike and Infrastructure Commission produced a public service video to raise awareness.

Ultimately, scammers are banking on human nature to make scams effective.

“Scammers want people to panic, not pause, so they use fear and urgency to rush people into clicking before they spot the scam,” said Amy Bunn, online safety advocate at McAfee. Bunn says that AI tools are making this type of scan more prevalent.

“Greater access to AI tools helps cybercriminals create a higher volume of convincing text messages that trick people into sharing sensitive personal or payment information – like they’d enter when paying a toll road fine,” Bunn said. McAfee research found that toll scams nearly quadrupled in volume from early January to the end of February this year.

Even if you know the text is fraudulent, she says it is important to avoid the urge to text them a few choice words or a simple “stop.” 

Don’t engage at all.

“Even a seemingly innocent reply to the message can tip scammers off that your number is live and active,” Bunn said.

Holland worries that the ones falling for the scam are society’s most vulnerable: the elderly and less tech-savvy people, even children who may receive the messages on their phones.

Others have an easier out for spotting a fraud.

“I got my first text yesterday; I just deleted it. The funny thing about it is that I don’t drive and haven’t for over 30 years,” said Millie Lewis, 77, of Cleves, Ohio.