A $6.85 toll text cost one commuter $940

The text looked official and the amount looked harmless. The payment page was there to collect his card.

What happened

Marcus, 34, drives the turnpike to work every day, so he didn’t think twice when a text said he owed $6.85 in unpaid tolls and would face a $50 late fee if he didn’t pay by Friday.

He tapped the link, which led to a page with the toll agency’s logo, and paid with his debit card. The page then asked him to confirm with a code sent to his phone. He typed it in.

Two days later, $940 in purchases from an electronics site in another country appeared on his account.

“I almost didn’t bother calling the bank. I thought, it’s only a toll.”

The scam

This is a toll “smishing” scam: a phishing text sent in bulk to millions of numbers. The small amount is the trick. Few people stop to check a $6.85 charge.

The page isn’t there to collect $6.85. It’s there to collect the card number, expiry date and security code. The “confirmation code” he typed in let the scammers add his card to a digital wallet on their own phone.

What Marcus did

Marcus called his bank the moment he saw the charges. They froze the card, issued a new one and disputed the purchases. Because he reported it quickly, he got all of the money back after a 10-day investigation.

He also forwarded the text to 7726 (SPAM), which lets his carrier block the sender.

Red flags

• A text about a toll, parcel or fine with a link in it.
• A deadline, a late fee or a threat to your licence.
• A web address that isn’t the agency’s real site, often ending in .xyz, .top or similar.
• “Reply Y and reopen this message to activate the link.”

How to protect yourself

• Toll agencies and the post office don’t ask for payment by text link. Check your account by typing the agency’s address yourself.
• Never share a code sent to your phone with a website or caller you reached from a text.
• Pay online with a credit card rather than debit when you can. Disputes are easier and your bank balance isn’t touched.
• Forward scam texts to 7726, then delete them.

Every story is a composite of commonly reported cases. Names, places, amounts and links are changed.