Another day, another scam, and this time E-ZPass users are the target. Here’s everything you need to know about the scam, how to keep yourself safe, and what you can do if you do get scammed.
Beware E-ZPass Text Scams and Phishing
People across the United States have been reporting text messages claiming to be from E-ZPass, an electronic toll system, about an “unpaid balance.” I received one myself.
Of course, this text message is loaded with red flags and warning signs that it isn’t legitimate. However, the biggest giveaway for me was the fact that I don’t have an E-ZPass.
You shouldn’t trust texts like this, generally speaking. Only pay tolls and other fees through official channels.
Assuming you do have an E-ZPass, here’s how you can spot this (and most other) text scam.
How Can You Spot a Text Scam or Phishing?
There usually isn’t one telltale sign that a text is definitely a scam, but there are some common factors that, when taken together, should usually set off alarm bells.
The biggest thing I noticed, behind “I don’t have an E-ZPass,” was the phone number. It originated from +226-60-65-29-24, which is not the standard format for a U.S. number.
A quick search revealed that 226 is the country code for Burkina Faso, a country in West Africa.
While it is relatively normal for companies to outsource support resources outside the country they’re servicing, you can and should expect any text notifications to originate from within the same country. In this case, it seems very unlikely that E-ZPass—a transponder system used on some highways in the United States—would be sending text notifications from Burkina Faso.
The next glaring red flag was the URL in the text—it was using a shortener.
URL Shorteners do exactly what they sound like: they make a long, unwieldly URL more concise. Sometimes they offer additional features, too, like data analytics related to what people do once they click your link.
However, it is pretty weird for something like E-ZPass, or toll billing in general, to use a URL shortener. If they text you at all, they’ll send something with the real URL, or advise you to use some other official payment channel. The a previous big toll-related scam was much more convincing, since it used realistic-looking URLs.
In this case, the shortened URL took me to a suitcase on Amazon, which seems like an odd choice for a scammer or a phisher. I’m not sure how inclined I would be to randomly buy a suitcase when I expected to be paying a toll to New York State.
Though it doesn’t appear to be relevant for this particular scam (or perhaps it is a phishing attempt), another huge red flag is the payment methods they accept. In general, legitimate businesses will be happy to accept credit or debit cards as payment methods. Both offer some protection in the event that you’re a victim of illegal activity—especially credit cards. In general, credit cards are the best option to use online if you have the option.
Why You Should Use a Credit Card to Shop Online
Are credit cards the best way to spend money online? Here are a few reasons why they might be.
If a website or service doesn’t allow you to use either, you should instantly be suspicious.
Scammers will often push you to use payment methods that have way fewer protections, like wire transfers, direct withdrawal from your bank account, or cryptocurrency transactions. Someone asking for a payment via crypto should usually give you pause, since they’re commonly involved in all variety of scams.
What Do You Do If You Fall For an E-ZPass Scam?
If you do fall for a scam, the first thing you need to do is get in contact with your bank, credit union, or other financial institution.
They may be able to put a stop on the payment so it isn’t processed, potentially saving you the trouble of trying to recover whatever funds you lost. They’ll also be able to issue you a new debit card or credit card if you used one of those methods. They may also advise you to file a police report.
If your payment did already go through, and the money is now “gone,” you should still contact your bank. They might be able to recover the funds for you, depending on how the money was transferred and where it went. There is no guarantee how long this will take—anecdotally, I’ve seen some issues resolved the same day, whereas others have had to wait weeks.
If you created an account as part of the scam, and you reused a password (which is something you should avoid), make sure you change the passwords of any accounts that share that password. If you don’t, you’re likely to find yourself victim to a credential stuffing attack.
Where Do You Actually Pay Your E-ZPass Bill?
E-ZPass isn’t centrally managed, and each state is handled separately. For example, if you live in New York State, you’d go to the New York Thruway website to pay your E-ZPass toll. If you live in Pennsylvania, you should go to the PA Turn Pike website instead.
Many of these websites end in “.gov,” and that is usually a sign you’re at the correct place. If you’re not sure, here is a quick list to get you started.
Each physical E-ZPass transponder also has a phone number that will connect you to the issuing agency for your state. When in doubt, use that.
