What looks like a simple message about an unpaid toll or package delivery fee is actually part of an organized cyber-crime campaign run by criminal groups in China.
The Scam Explained:
According to the Department of Homeland Security, these crime rings are using fake toll and postal fee notifications to trick people into entering their credit or debit card details. Once victims click the link and “pay,” their card data is stolen.
The stolen numbers are then loaded into Google Pay and Apple Wallet accounts in Asia and instantly shared with U.S. gig workers. This digital pipeline lets scammers tap-to-pay for iPhones, gift cards, clothing, and cosmetics — without triggering two-factor authentication.
Behind the scenes, at least 38 SIM farms across major U.S. cities are blasting out up to 1,000 scam texts per minute. Researchers at Proofpoint recorded 330,000 toll-scam texts in a single day, with volume now running 3.5× higher than earlier this year.
Why It Works:
Because these transactions happen through mobile wallets, banks often can’t block them fast enough. Traditional fraud alerts and verification codes are skipped, making it difficult for victims to notice until the damage is done.
How to Protect Yourself:
- Do Not Engage with the Texter. Do not reply to the message, including pushing a button or responding "Y" or "N."
- Do Not Click any links embedded in the text. Never click links in texts about tolls, deliveries, or missed payments.
- Find Out if the Text Message Is Legitimate. Go directly to the official website or app of your toll or delivery service.
- Block the Number. Consider blocking the sender's number to prevent future scam attempts.
- Report the Scam to Law Enforcement. If you suspect a text message is a scam, report it to the Internet Crime Complaint Center (IC3) at www.ic3.gov.
- Do Not Share Your Info. Never share personally identifiable information or financial information in response to unsolicited or suspicious messages.
- Don't Be Bullied. Any request you receive urging immediate action can lead to a rushed response that may be unwise.
- Use 2FA to protect your accounts. Use multifactor authentication wherever possible.
- Monitor your accounts for unusual activity. Report unauthorized charges immediately. You can usually set up alerts with your bank for unusual charges and activity.
- File a Complaint with the FCC. Your information helps to inform FCC enforcement and policy efforts, and helps us raise public awareness of these scams.
Bottom Line:
Scammers are becoming more sophisticated every month. The best defense is awareness, layered security, and trusted digital tools.
Stay safe, stay secure, and always think before you tap.
