Bonus: Toll Road Scams Are Trending

(MUSIC INTRO)

[00:00:01] Bob: This week on The Perfect Scam.

[00:00:05] Eva Velasquez: These scammers, they love to take something that has a kernel of truth or some tidbit of reality and then they spin their yarn around that. So yes, it is true that if you don't pay a toll in a timely manner, they will issue fees. People do feel that sense of urgency, but that's why they're doing it. They're, they're testing the waters and unfortunately, they're finding that the water is very warm.

(MUSIC SEGUE)

[00:00:37] Bob: Welcome back to The Perfect Scam. I'm your host, Bob Sullivan. Summer is practically synonymous with road trip and you know what's often synonymous with road trip, toll roads. We've all gotten used to putting a little gadget in our car so we can pay a toll electronically. On the East Coast they call it an Easy Pass. In Washington State they call it Good-to-Go, but have you ever been driving through a state on a road trip and you end up on a toll road and you don't quite know how to pay the toll? You drive through figuring you'll get a bill in the mail or whatnot, fingers crossed that you don't end up with some kind of outrageous fine which you get anyway. Maybe I'm being a bit too autobiographical here, but anyway, that kind of anxiety opens the door to one of the newest scams, and we wanted to tell you about it right away. So today is a special bonus episode. Electronic tolling, like so many other modern electronic conveniences, is being abused by criminals. Anyone who took a road trip this summer, really anyone who drives a car needs to hear today's story. Fortunately, we have Eva Velasquez from the Identity Theft Resource Center to explain how criminals are making money off, well let's call it unpaid toll anxiety. For those of you who don't know the ITRC...

[00:02:08] Eva Velasquez: ITRC's been around for 25 years, we're a 501(c)(3) nonprofit, and we provide free services to victims and concerned consumers regarding identity crimes, data breaches, scams and fraud. I mean anything that really touches the misuse or an encumbrance on an identity, we have recovery plans and risk minimization plans and that we provide to the public at no cost.

[00:02:39] Bob: And you do a lot, and I will give you time to talk a little bit more about what listeners might be able to do with you. Um, but right now I have to get right into an important question I have. I think you know that I used to live in Seattle. I still have a Seattle phone number, and I got a text message on July 7th at 6:23 pm that stopped me in my tracks, and I'm going to read it to you, okay?

[00:03:00] Eva Velasquez: I'm ready.

[00:03:02] Bob: "Washington, My Good to Go Toll Services, our records indicate that your vehicle has an unpaid toll invoice. To avoid additional charges of $66.70, please settle your balance of $6.67 at mygoodtogotoll.com." Now, of course, I stopped immediately and thought, how could I have an unpaid toll? I haven't driven in Washington State in several years, but maybe there is an oh no, a $6 toll is going to cost me $60 now? I'd better click on this. But fortunately, I didn't click on it because I thought of a warning that you guys issued back in May. So what is this text message, Eva? First of all, it, it's a scam, this message isn't real, right?

[00:03:43] Eva Velasquez: Absolutely. This is a scam. Unfortunately, we're seeing these toll road scams really proliferating all across the country. These text messages, they are a scam, and it's not just the toll roads. We're seeing more and more segmented by area code types of text scams that, from toll roads to fishing and game licensing, to other types of government services, even to law enforcement. So they're using that geography, your area code on your, with your phone number. I think what's interesting about this scam is that the way that you are able to kind of call it out, uh immediately was I don't, I don't live in Seattle anymore. So the folks who are taking their cellphone number with their area code kind of with them as they move across the country are a little bit less likely because they think, oh, I haven't driven on a toll road since I lived there, but it's very, very uh enticing and it works for, for many people because they still do live in that area.

[00:04:47] Bob: Or it's summer as in maybe they drove through the area because of a road trip, right?

[00:04:50] Eva Velasquez: Right, vacation, vacationers, we got a lot of those from Florida, folks who were like, well I was in Florida, but I don't think I was on a toll road. And, and we're seeing this across numerous states. I mean we’ve had victims from Virginia, North Carolina, Colorado, Ohio, New York, New Jersey, they're, Texas, California. The list goes, goes on and on and it, and it's ever-growing.

[00:05:16] Bob: That's a, a long list and I see back in May and I did, I do remember that you issued a warning about this back in May, that you had gotten 2000 or the FBI I think, had received 2000 complaints about this. That sounds like a lot of complaints in a short span of time.

[00:05:29] Eva Velasquez: I'm sure that that has multiplied monumentally, because we know that this is going out. Think about the cost. It doesn't cost anything to send these messages out, and so if these bad actors get even one one-thousandth of a percent rate of return, it's very lucrative to them. The toll fee is usually a very small amount. For you, you said it was $6, but there, there could be a late fee. That's the fear of consequences that we're seeing. That's the hook. Oh, it's a small toll; 5, 6, 12 dollars, we've been trying to reach you, if you don't pay it today there's going to be a late fee of 50, 60 dollars and that's another thing that entices people to react and click on the link and, and say oh, I've got to get this taken care of, or else it's going to be a lot more than $6.

[00:06:20] Bob: Well I don't know about you, but this has actually happened to me where I had a toll at a, from another state that I didn't know about that should have been, you know, a couple of bucks, but because I didn't get the letter in time and respond within 15 days or whatever they gave me, it turned out to be 50 or 75 dollars which made me furious, but so this is also you know realistic. I mean people are, are ready to be unnerved by messages like this, so I think they're tapping into some you know anger with that's, that's realistic about toll roads.

[00:06:50] Eva Velasquez: Well and think about it. If you kind of go up to the high level like the 30,000-foot view, this has all of the attributes of a successful scam. Because you're right. That feeling of I must react, but there's something real here. These scammers, they love to take something that has a kernel of truth or some tidbit of reality and then they spin their yarn around that. So yes, it is true that if you don't pay a toll in a timely manner, they will issue fees. And yes, Bob, I hate to admit it, but there is a toll road a little bit north of me when I go to visit my husband's parents that we drive, and I, one time, didn't load up my account, and I had to pay a late fee. And it is infuriating. So it is real. People do feel that sense of urgency, but that's why they're doing it. They're, they're testing the waters and unfortunately, they're finding that the water is very warm.

[00:07:48] Bob: Okay, so if I did click on that link, what happens? What are they really trying to ultimately do to me?

[00:07:53] Eva Velasquez: They're trying to get your financial information and other identity credentials. They're either going to try to get you to enter payment information, log-in credentials. They'll take as much as they can but the end goal is to try to get your debit card, credit card, bank account, financial information. If you have an account with the toll road, they may be trying to get your username and password. It's about getting your data and your money.

[00:08:19] Bob: Hmm. Okay, so now I do, I'm a big fan of the Identity Theft Resource Center, always have been. And thank goodness you've issued this alert back in May. But I would like to just raise this point; since you issued an alert in May and you read off the list of a dozen or so states back in then that had been reporting this, it's now the end of July for me. Why is this still happening?

[00:08:41] Eva Velasquez: Well I think the challenge is, and I've heard this too; why isn't the government doing anything about this? And it's more complicated than that. The phone companies will have to intercede and block some of these numbers, and there are apps that do that, and there are some services, things that you can purchase. There's some that are already imbedded depending on your service provider, but the scammers know that if they change the number where it's coming from, the sending account, quickly, it's not that expensive to do that, and they just rotate accounts and use new accounts. So it's sort of like playing a game of whack-a-mole.

[00:09:20] Bob: So it's hard for the cell carriers to stop all these messages, although it does strike me that the messages really do sound kind of similar and I'm, I'm surprised that there's not a little bit more they can do. But also, in the case of my message, the domain name that they suggested that I click on was very realistic. The, the Washington State version of Easy Pass is called Good to Go. And that the URL that they sent to me was mygoodtogotoll.com. That's a domain that, that sounds like it could really be a legitimate uh domain for that toll collection agency. So why, why isn't it that the scam stopped at that level maybe, at the domain level?

[00:09:55] Eva Velasquez: That is a good question, and part of it is we, we are able to secure domains. You just make up one and, and you easily go and register it, and it is up to the organizations that own the legitimate domain name to police their own domain. So a lot of this isn't centralized, and I agree with you; this is one of the aspects of this scam as well. Most of the, the names and the domains look very, very believable. Gone are the days of it being some off the wall, doesn't match, you don't even believe, you know, it's like so unbelievable looking. Now they look very, very similar sometimes with only a letter or two difference from the legitimate domain name, and so from a prevention standpoint, we always tell people go to the source. And the great news about that advice is that it really applies across the board. If you didn't initiate the communication whether it's coming by email, text, the phone call, you don't have to engage with that message. You can go to the source. So we encourage people if they get one of these tolls and they think there's a chance that it's legitimate, that if they have an account, go ahead and go to their legitimate account, however they communicate with their toll road service provider. And if they don't, make sure, don't go to the domain that's listed on the text message. Make sure that you are doing your research and looking up what is the legitimate domain name for the entity in my area. And if you have trouble with that, you can always call the ITRC and we can walk you through how you verify the legitimacy of any incoming communication.

[00:11:43] Bob: You know, just to complete the story from my text message, again it had been many years since I paid a Good to Go toll; the correct website is mygoodtogo.com. They were sending me to mygoodtogotoll.com. And if you go to the right one, mygoodtogo.com, there's a big warning at the top of it that says, "SCAM ALERT" and it's specifically asking for $6.67. So they know I got this scam message. But boy, that URL, first of all, that URL sounds really legitimate. Second of all, you know what, Eva, I could not remember that I was supposed to go to mygoodtogo.com. How would I remember that?

[00:12:20] Eva Velasquez: Right. If you haven't gone in a while, I can understand how that would be hard to have that memorized. So you're not engaging with this company anymore because you've moved away. It's a challenge because when you do an internet search, you do have to be really careful about making sure that you're finding the legitimate one. And that's why I then say, if it's not easily discoverable, if you're like, no, I cannot figure out what is legitimate and what isn't; that's when you can go to a trusted third party like the ITRC, like the Better Business Bureau is also a great resource, like AARP. I mean we all have call centers where you can reach out to us and say, I need help finding the legitimate website for this company, this entity. And we can walk you through that.

[00:13:07] Bob: I, I think that's really important. Um, but a quick Google search may or may not give you the right answer, so get it from somebody else too. Let me confess a character flaw that I have. I'm the kind of person that when I get a, a parking ticket or something like this, I mean I get, I go to 11 right away, and I got to, I've got to fix this immediately. So I'm going to just pay this toll because I feel like now I’m a criminal. I have to exonerate myself or, or dispute it or whatnot. So I, my urge is to just act immediately, which really would have worked against me in this case. In this case this is one of those times when take 10 minutes and do it the right way. Don't, don't act just because you're upset you got a parking ticket or a fine, right?

[00:13:45] Eva Velasquez: Absolutely. I think the mantra that I want you and everybody else to remember is react, don't panic. Look, I appreciate your honor, that's an honorable way to live your life. If I made a mistake, I am going to resolve it and take care of it. And I actually think that's a good way to live. But it doesn't mean that you have to engage immediately. That is something that the bad actors rely on. You can take 5, 10 minutes, think through what your next move is, and I always go back to that, reach out to a friend. Call someone that you trust and run the scenario past them, whether it's the, the toll road scam or any other incoming communication and, and hopefully they can help you talk you out of, oh, I need to take care of this right away. There's time. You are still an honorable person. You can vet whatever is coming in, and then you can take care of it appropriately.

[00:14:39] Bob: So what are you supposed to do if you get one of these messages?

[00:14:43] Eva Velasquez: Well, again, I tell people, react, don't panic. The, in the, the very, very likely scenario is that it's a scam, and now how these toll companies communicate with their customers is going to vary from company to company. But if you want to be proactive about it, and you are one of those people that has a toll account and um, engages and drives the toll roads, go now before you get one of these text messages and ask the question. Find out. Do you communicate with your users over text, or do you only communicate via email or phone call? How do you communicate with us? Most of them are going to say they write a letter. That seems to be the standard, but I don't want to say that as an absolute because I can't say that I know with certainty that's how it is in every state. But if you do get one and you're not sure, have a legitimate company communicate with their customers, you can do, again, a little sleuthing, check around, phone a friend, go to the source and if you still are confused about who you're talking to, go to a trusted third party that can give you direction.

[00:15:52] Bob: And if I get it and I decide it's a scam, do I need to tell someone? Can I report it somehow?

[00:15:57] Eva Velasquez: You can report it to IC3.gov. And it's helpful when you report these scams because then we know the scope and the scale of the crime. It only takes a few minutes to do that online. But I do want to give people um, I want to manage their expectations. If you did not click on the link and you haven't shared your data or your, your financial information, you're most likely not going to hear anything back. It's not necessarily going to be investigated. Now if you did click on the link, and you did share your information, then we need to walk you through the recovery process, and it's going to differ, we need to know what exact information you shared, because that's where we need to shore up the defenses. If you shared your credit card information, I'm going to encourage you to, you know, contact your bank, let them know, and then follow their advice on whether they close that account or they flag it and put a fraud warning on it. It's going to vary from institution to institution. If you shared other data, I don't want to go into all the details for every type, we don't have, you know, three days for this podcast, but if you shared other information, reach out to the ITRC, we'll be happy to give you a free recovery plan that will minimize your risk of that particular information now being out there in the wild.

[00:17:17] Bob: Well that brings us to an important question. If somebody is worried that something has happened to their identity, like they've answered a text like this and supplied personal information, how do they get in touch with the organization?

[00:17:27] Eva Velasquez: Oh you can reach us in, in a variety of ways. You can call our toll-free number, that's 888-400-5530. You can live chat with us online and our website is IDtheftcenter.org. You can send us an email and our email accounts are listed on the website. You can message us, social media direct messaging. I'm trying to get carrier pigeon and smoke signal, but we're working on that communication method.

[00:17:56] Bob: One thing at a time.

[00:17:57] Eva Velasquez: Right?

[00:17:58] Bob: You know I would very remiss to have you on this podcast and not ask you, are there other scams or crimes that you're starting to hear about now that our listeners should know about? Something new perhaps?

[00:18:09] Eva Velasquez: Well I think my big concern is these geographically segmented text scams that are relying on your area code. And it, it's really running the gamut, and I'm going to encourage people that anything that feels very personal about where you live, these government departments, like I said we're, we're seeing them for Fish & Game, you've got to renew your, your license. Just anything that is about your specific region that's unsolicited text message that is compelling you with a sense of urgency; either you owe money or something's going to expire or you must act now. I just really want people to take a breath and not react to that. And I think we're going to continue to see this escalate and increase significantly because look, the bad actors, they are masters of AB testing. They try one thing, it doesn't work, they try another, they try another and then when they find something that works, they just go full force, and they put a lot of resources into it. So I don't think this is going to die down anytime soon. It eventually will, but we'll have this elevated baseline. I think these are here to stay, so I just want people to be really vigilant.

[00:19:29] Bob: And, and I just keep hearing about them from different states. So it must be working because these things certainly are out there, right?

[00:19:35] Eva Velasquez: They haven't slowed down. So I, the list of states where these are happening is growing, and it's not slowing down yet, so I think this is going to be around for quite a while.

[00:19:45] Bob: A really, really important reminder during summer road trips, especially because the odds are higher, I think than normal that you might really have to pay a toll from a state you don't normally pay to, and so you might get an unexpected communication, probably a letter from a toll authority. So just take an extra moment.

[00:20:05] Bob: Also I want you to know that these scams are ever evolving. Right after I had this conversation with Eva, a friend sent me a text message that he'd received that had the logo for New Jersey's Easy Pass system in it. And in the background image was a picture of a bridge, could be the George Washington Bridge, and that it said, "Your recent journey on a New Jersey Easy Pass toll road resulted in the charge of $4.15. Settle your balance promptly to prevent any late fees." Then there's a link to EZ Pass NJ dot net; it's not quite the right URL, but it's very believable. Just ignore these messages, and if you just want to double-check that everything is okay, go to a web browser. Type the domain of your toll collection authority manually and check your account. And if you've answered a message like this, or you're just worried about it, you can always call the AARP Fraud Watch Network Helpline at 877-908-3360 from 8 am to 8 pm Monday through Friday. Happy motoring!

[00:21:15] Bob: For The Perfect Scam, I'm Bob Sullivan.

(MUSIC SEGUE)

[00:21:23] Bob: If you have been targeted by a scam or fraud, you are not alone. Call the AARP Fraud Watch Network Helpline at 877-908-3360. Their trained fraud specialists can provide you with free support and guidance on what to do next. Our email address at The Perfect Scam is: theperfectscampodcast@aarp.org, and we want to hear from you. If you've been the victim of a scam or you know someone who has, and you'd like us to tell their story, write to us. That address again is: theperfectscampodcast@aarp.org. Thank you to our team of scambusters; Associate Producer, Annalea Embree; Researcher, Becky Dodson; Executive Producer, Julie Getz; and our Audio Engineer and Sound Designer, Julio Gonzalez. Be sure to find us on Apple Podcasts, Spotify, or wherever you listen to podcasts. For AARP's The Perfect Scam, I'm Bob Sullivan.

(MUSIC OUTRO)

END OF TRANSCRIPT