Just as phishing scams target emails, smishing scams (a combo of the word "SMS" and "phising") target your texts. Fraudsters con unsuspecting victims on both iPhones and Android phones into sharing personal information.
The latest smishing campaign involves scammers texting about unpaid toll charges. And these smishers are widespread, targeting Georgia’s PeachPass, Florida’s Sun Pass, Texas’s Texas Tag, California's FasTrak and EZ-Pass, which is widely used on the East Coast, among others.
The user is urged to visit a website and pay an arbitrary toll amount to avoid a $50 fine. Messages typically read something like this:
"[State Toll Service Name]: We've noticed an outstanding toll amount of $12.51 on your record. To avoid a late fee of $50.00, visit https://*********tollservices.com to settle your balance."
The URL is intended to mimic a legitimate official state toll service but leads users to a fake site.
Protect yourself from identity theft
The FBI Internet Crime Complaint Center started receiving thousands of complaints about toll collection scams in March of last year. In the past three months, the number of texts has skyrocketed 900%, with 60,000 domains associated with the scam traced back to Chinese networks.
In February, the NYPD posted a message on X warning the public not to click links from EZPass or Amazon (another common smishing scam).
The Ohio Turnpike issued a warning on YouTube about EZ Pass fraud in March.
The scammers have reportedly used AI to change numbers faster than Android can block them and managed to bypass Apple safety features.
If you receive a smishing text, contact the Internet Crime Complaint Center with the number the text originated from and the website URL listed in the message.
You may also want to check the status of your account with your toll service provider and notify them you were targeted by fraudsters.
What is identity theft protection?
Everyone is vulnerable to scammers, but screening your texts and avoiding clicking on links or sharing personal information can help.
You can also subscribe to an identity theft protection service that utilizes credit monitoring and dark web scanning, among other tools, to keep your information secure.
And if you are the victim of fraud, they can offset expenses related to restoring your identity.
Offers in this section are from affiliate partners and selected based on a combination of engagement, product relevance, compensation, and consistent availability.
Plans from $10 to $32 per month, billed annually
Protects against identity theft, fraud, spam calls and websites, viruses and malware. Offers three-credit-bureau monitoring, VPN, dark web monitoring, password manager, email aliases and instant credit lock.
On Aura's site
From $7.50 to $25.00 per month, billed annually on individual plans and $12.50 to $33.33 per month, billed annually on family plans
Up to $1 million in insurance for eligible losses from identity theft
On Identity Guard's site
Identity theft protection services scan databases for your personally identifiable information (PII), such as your Social Security number, driver’s license and bank account numbers, if they turn up on
- Social media
- U.S. Post Office address change requests
- Court or arrest records
- Orders for new utility service
- Credit card and loan applications
- The Dark web
Top options like Aura, IdentityForce® and PrivacyGuard™ include credit monitoring and identity theft insurance, which can pay out up to $1 million to help you recoup legal fees, lost wages and other expenses.
Aura
Cost
Kids: $13 per month or $10 per month billed annually; Individual: $15 per month or $12 per month billed annually; Couple: $29 per month or $22 per month billed annually; Family: $50 per month or $32 per month billed annually
Standout features
Protects against identity theft, fraud, spam calls and websites, viruses and malware. Offers three credit bureau monitoring, VPN, dark web monitoring, password manager, email aliases and instant credit lock.
Identity theft insurance
All plans include at least $1 million and white-glove fraud remediation
Terms apply.
IdentityForce®
Cost
UltraSecure Individual: $19.90 per month or $199.90 per year; UltraSecure+Credit Individual: $34.90 per month or $349.90 per year; UltraSecure Family: $24.90 per month or $249.90 per year; UltraSecure+Credit Family: $39.90 per month or $399.90 per year
Credit bureaus monitored
3-bureau credit monitoring, alerts and reports: Experian, Equifax and TransUnion®, with UltraSecure+Credit Individual and UltraSecure+Credit Family plans only
Credit scoring model used
VantageScore® 3.0, with UltraSecure+Credit Individual and UltraSecure+Credit Family plans only
Dark web scan
Yes, with all plans
Identity theft insurance
Yes, at least $1 million with all plans
Terms apply.
PrivacyGuard®
Cost
$9.99 to $24.99 per month
Credit bureaus monitored
Experian, Equifax and TransUnion
Credit scoring model used
VantageScore
Dark web scan
Yes, for Identity and Total Protection plans
Identity insurance
Yes, up to $1 million for Identity and Total Protection plans
Terms apply.
Smishing FAQs
What is smishing?
A portmanteau of phishing and SMS, smishing is a phishing attack that uses text messages to trick victims into sharing personal information or clicking on malicious links. They often impersonate government agencies, banks and other legitimate outlets to lull the user into a false sense of security.
Why are smishing attacks particularly effective?
Smishing attacks are especially effective because people trust SMS messages more than emails or phone calls. They assume the sender knows them or has legitimate access to their phone number. They often employ a sense of urgency or threat, leading to a much higher open rate.
How do I prevent smishing?
You may not be able to stop a scammer from sending you a smishing attack but being skeptical about unsolicited messages that urge quick action is the best defense. Identity theft protection services can also scan for your personal information and help restore your identity if there's a breach.
What's the difference between phishing and smishing?
Phishing is a cyberattack using email to trick victims into sharing personal information or clicking on links. While similar, smishing uses text messages (SMS) to the same effect.
Why trust CNBC Select?
At CNBC Select, our mission is to provide our readers with high-quality service journalism and comprehensive consumer advice so they can make informed decisions with their money. Every mortgage product review is based on rigorous reporting by our team of expert writers and editors with extensive knowledge of mortgage products. While CNBC Select earns a commission from affiliate partners on many offers and links, we create all our content without input from our commercial team or any outside third parties, and we pride ourselves on our journalistic standards and ethics
Money matters — so make the most of it. Get expert tips, strategies, news and everything else you need to maximize your money, right to your inbox. Sign up here.
Catch up on CNBC Select's in-depth coverage of credit cards, banking and money, and follow us on TikTok, Facebook, Instagram and Twitter to stay up to date.
