iPhone smishing scam explained as Chinese cybercriminals force FBI to respond

If you live in the US, then chances are you've heard of a nasty new scam going round.

The 'smishing' con - in which victims are targeted via SMS - has seemingly exploded in recent weeks, with people taking to social media to share unusual text messages they've received.

Previously, the FBI warned us to immediately hang up the phone if we get a certain type of call. And now iPhone and Android users have this 'road toll' tactic to be aware of.

This new trap claims people have unsettled road tolls to pay, prompting them to enter their card details via a third-party website.

You can connect the dots to imagine what happens next.

And now, a security expert reckons he knows where this new approach originated from.

What is the road toll smishing scam?

The Federal Trade Commission (FTC) explained that 'scammers are pretending to be tolling agencies from coast to coast and sending texts demanding money'.

They said: "The scammy text might show a dollar amount for how much you supposedly owe and include a link that takes you to a page to enter your bank or credit card info — but it’s a phishing scam."

"Not only is the scammer trying to steal your money, but if you click the link, they could get your personal info - like your driver’s license number - and even steal your identity."

Even those in states without toll roads or people without a drivers licence are being targeted.

Who is behind the road toll smishing scam?

Ford Merrill, a security researcher from SecAlliance, says that Chinese cybercriminals are likely behind the explosion of these road toll scams.

As per Krebs on Security, Merrill claims a cybercriminal group 'known for selling sophisticated SMS phishing kits' began offering new phishing pages 'designed to spoof toll operators in various US states.'

Thousands of scammers are estimated to have bought these kits, triggering the current tidal wave of scam messages.

Merrill explains that the ultimate goal of these kits 'is to phish enough information from victims that their payment cards can be added to mobile wallets and used to buy goods at physical stores, online, or to launder money through shell companies.' (The latter is a business that usually has financial assets and holds funds but has no active operations.)

In the past, these phishing tools have impersonated postal services, shipping companies and even government departments, Merrill said.

“What we’re seeing with these tolls scams is just a continuation of the Chinese smishing groups rotating from package redelivery schemes to toll road scams,” he explained.

“Every one of us by now is sick and tired of receiving these package smishing attacks, so now it’s a new twist on an existing scam.”

What to do if you get a smishing text

If you're on the receiving end of one of these dodgy texts, the FCT advises: "Don’t click on any links in, or respond to, unexpected texts. Scammers want you to react quickly, but it’s best to stop and check it out."

Next, you should check to see if the text is legit. "Reach out to the state’s tolling agency using a phone number or website you know is real — not the info from the text," the FCT added.

Finally, they said: "Report and delete unwanted text messages. Use your phone’s report junk option to report unwanted texts to your messaging app or forward them to 7726 (SPAM).

"Once you’ve checked it out and reported it, delete the text."

The FBI's Internet Crime Complaint Center is also aware of the texts, The Independent reports, and advises anyone who receives a similar text to report it to them - which you can do here.