Steve Weisman is a lawyer, college professor, author, and one of the country’s leading experts in cybersecurity, identity theft, and scams. See Steve’s other Con Watch articles.
Toll road transponder systems such as E-ZPass enable drivers to travel through a special lane where their transponder is electronically read, so they don’t have to stop and pay the toll each time. The tolls are then charged to a credit card on file with the company. It’s a very efficient system that works well. Unfortunately, it also works well for scammers.
In 2014, crooks started sending phishing emails to residents of New York, New Jersey, Massachusetts, and even Canada that read: “Dear customer, You have not paid for driving on a toll road. This invoice is sent repeatedly, please service your debt in the shortest possible time.” People would be scammed into providing personal information, including credit card numbers, that would lead to credit card charges and identity theft.
Ten years have passed since that scam first started, but it hasn’t changed that much. Massachusetts, New York, Pennsylvania, Florida, Wisconsin, Ohio, Connecticut, and California are among the states that have issued warnings about the scam that now comes from phony text messages, where you are prompted to pay a small amount, generally between $3.95 and $12.55, to bring your account up to date. However, victims of the scam end up losing much more than these small amounts; the scammer proceeds to run up large charges on the victim’s credit card. These text messages are being sent to people in states that don’t even have toll roads.
Unlike the 2014 email phishing version where observant people might notice the email address appeared to not have originated with the transponder company, the text messages of today may appear to come from a phone number associated with the legitimate company through spoofing, where a scammer can easily change the phone number that appears on your caller ID.
The simplest way to recognize a phony toll road message? E-ZPass and most other transponder companies do not text customers asking for payments.
As always, never click on links or download attachments regardless of how official the messages may appear. You can never be sure as to whether it is legitimate or not. If you have any concern that the message may be real, contact the transponder company through an email address or phone number you get through their actual website (not the link provided in the text message).
Also, never use your debit card for anything other than withdrawing cash from an ATM. When you pay with a credit card, your liability limit for fraudulent payments is $50, and most card issuers don’t hold you responsible for any fraudulent charges when you promptly report the fraud. On the other hand, when you use your debit card, you are making a direct withdrawal from the bank account tied to your card. If your debit card is used to make fraudulent purchases, your liability is $500 if you do not report the fraudulent use within two business days. After 60 days, your liability is unlimited. Potentially, you could lose your entire bank account. In addition, your bank account will be frozen, and you will lose access to your own funds while the bank investigates the matter.
Like many modern technologies, toll road transponders are a wonderful convenience, but that convenience almost always comes with a price.
Become a Saturday Evening Post member and enjoy unlimited access. Subscribe now
