America is awash at the moment with a “toll-fee SMS scam.” As many state governments have alerted residents, you may receive an SMS from an unknown number claiming that you owe an unpaid toll and demanding that you pay. Because tens of millions of people have payment accounts linked to license-plate-based or RFID-scanned systems, it sounds credible. And if you don’t, you might think that your license plate was linked to your phone number in some government database.
Apple provides a subtle tool you can use to avoid being scammed by this and other smishing (SMS phishing) con jobs that rely on clicking a URL:
When you receive an SMS from an unknown party that contains a link, Messages doesn’t make that link clickable.
However, if you reply to an unknown sender, Apple assumes you know the party and activates links after that reply. This is why the scam messages note, “If the link fails, reply ‘Y’ to retry, or copy and paste it into your browser.” That’s a sure sign not to.
Washington State DOT
The best advice:
- Any unknown message that arrives with a URL is probably a scam.
- If it says you need to reply to activate the URL, it is 99.9 percent certain to be a scam. (Or a badly run business.)
- If you believe it’s valid, don’t reply and don’t copy the URL. Instead, go to the originating authority’s website to obtain more information, whether a department of transportation tolling agency, a credit-card site, or a package delivery service.
- On an iPhone, tap the Report Junk link in the conversation. This option disappears if you reply.
- Block the incoming number using Apple’s built-in tools.
As with all phishing and smishing attempts, the scam artists try to trigger your fear impulse by saying “final notice!”, claiming they represent the government, or making other threats. When you receive a text like this in the future, recognize the odds of it being accurate are low, and you can easily check without responding to the message, just in case it’s true.
Some companies haven’t gotten the, er, message that they shouldn’t demand payment through SMS. I had a bulk shipment of a book I wrote inbound from Canada a few weeks ago. I received a pile of SMS messages related to it, claiming fees were required. It turned out they were! But the company should have said, “Log into your account on our website,” and not provided a link. It’s just not a trustworthy way to do business anymore.
Author: Glenn Fleishman, Contributor, Macworld
Glenn Fleishman’s most recent books include Take Control of iOS and iPadOS Privacy and Security, Take Control of Calendar and Reminders, and Take Control of Securing Your Mac. In his spare time, he writes about printing and type history. He’s a senior contributor to Macworld, where he writes Mac 911.