Bitdefender Labs Warns of Global Fake Toll Text Scams

A new mass smishing campaign uncovered by Bitdefender Labs shows that scammers are sending tens of thousands of fraudulent text messages to mobile users across 12 countries, impersonating transport authorities, toll operators, and parking services.

Since December 2025 through April 2026 , Bitdefender Labs has been monitoring ongoing smishing campaigns targeting drivers worldwide.

So far, according to Labs’ researcher Alecsandru Catalin Daj, fraudsters used:

All messages a common goal: to persuade recipients to pay a fake fine, hand over sensitive information or install spyware.

While the activity is widespread and highly coordinated, Bitdefender Labs has not attributed these scams to a specific threat actor or group .

At this stage, there’s no confirmed link tying these campaigns together, beyond a shared theme of messages unpaid tolls, parking violations, or traffic fines.

What connects them are similarities in tactics, messaging, and delivery methods, rather than a clearly identified single source.

These scam messages are designed to create a sense of urgency and pressure drivers into acting quickly. A typical message claims that the recipient has an unpaid toll, traffic fine, or parking ticket and sets a short deadline, usually between 24 and 72 hours, to resolve the issue. To increase the sense of risk, the message often threatens consequences such as additional fees, license suspension, legal action, or even arrest warrants. It then prompts the recipient to click a link to “resolve” the matter.

That link leads to a fraudulent website designed to closely resemble an official government or toll payment portal. Once there, victims may be asked to enter sensitive information, including card details, personal data, and in some cases, banking credentials. In certain regions, the attack goes a step further by delivering malware instead of a payment page.

The largest smishing campaign we’ve tracked targets drivers in the United States.

The messages rotate between well-known and trusted entities including:

Here we’ve identified:

In Canada, particularly in British Columbia , the scam evolves into a more complex attack.

It starts as a parking citation message , but doesn’t stop there.

This means victims may first attempt to pay a fine, then unknowingly provide online banking details , leading to a much broader financial compromise.

One of the most recent identified waves of scam messages is targeting users in the United Kingdom , using a simple but effective lure related to road or journey payments.

Unlike other regions that rely on threats or penalties, this campaign uses a low-friction approach :

In Ireland, scammers are impersonating eFlow , the electronic toll system used on the M50 motorway.

Researchers identified:

The messages claim a toll is unpaid and direct users to a payment link.

In Australia, scammers are impersonating Linkt , a legitimate toll operator used across New South Wales, Victoria, and Queensland .

What makes this campaign particularly persuasive is how the messages are delivered.

We’ve observed over 2,200+ shortened URLs used to hide malicious links

The sender name is spoofed as “Linkt,” which can cause the message to appear in existing, legitimate message threads on some devices.

In New Zealand, scammers are impersonating NZ Police and the Ministry of Justice , targeting users with messages overdue traffic fines.

The messages claim a traffic fine is overdue and warn of escalating consequences if not paid.

In France, scammers are impersonating ULYS , sending messages in French that closely resemble legitimate toll notifications.

Researchers identified:

The messages claim that a small toll amount remains unpaid and must be settled quickly.

In Luxembourg, scammers are impersonating Guichet.lu , the official government services portal, using formal messages related to parking violations.

The messages claim a parking infraction has been recorded and must be resolved to avoid additional penalties.

The second-largest wave of scam messages has been targeting users in Colombia, particularly in Bogotá, Antioquia, and Valle del Cauca .

The messages impersonate toll operators and traffic authorities , using multiple sender numbers to distribute the scam at scale.

All links ultimately redirect users to phishing pages designed to collect payment details.

In Spain, scammers are impersonating the DGT (Dirección General de Tráfico) , the official traffic authority.

Researchers identified:

The messages are written in Spanish and warn users an unpaid traffic fine.

In Brazil, scammers are combining traffic-related themes with tax-related pressure , targeting users with messages obligations tied to their CPF (Brazilian tax ID) .

Researchers identified:

The messages warn users an alleged open obligation and urge them to act quickly to avoid restrictions.

In India, the campaign takes a more direct approach by delivering malware disguised as traffic fine notices .

The messages impersonate:

Unlike other regions, the goal here is not just to collect payment details but to install malicious APK on the victim’s device .

Even though the messages come from different countries and impersonate different agencies, they a very similar pattern designed to pressure you into acting fast.

The “escalation” tactic

Most messages follow the same script:

Bitdefender researchers also observed several techniques meant to bypass phone protections and make messages look more convincing:

“ Y” before clicking

Some messages ask you to first. On iOS devices, this activates links that would otherwise be blocked, making the scam easier to access.

Messages that look identical to legitimate ones

Multiple scam campaigns substitute Cyrillic lookalike characters (е, ѕ, м, і, т) for their Latin equivalents, to bypass keyword-based SMS spam filters.

Websites that mimic government pages

Links often include words like “gov” or “official,” even though they lead to fake domains.

Messages may appear to come from trusted brands or authorities and can even show up in existing message threads. Examples include "Linkt" in Australia and "miMultas" in Spain, which cause messages to appear in the victim's existing legitimate brand thread on some devices.

Hidden or shortened links

URL shorteners disguise the final destination, making malicious links look harmless.

Constantly changing domains

The scam sites are frequently replaced, helping campaign stay active even after some links are blocked.

While many of these scams aim to steal payment details, some cases go further.

We’ve spotted hybrid attacks especially targeting drivers in India. Here, the text messages include direct “Download” calls to action , pushing users to install apps like Rtochallan.apk hosted on platforms such as GitHub.

According to researcher Adina Mateescu , the app typically loads a fake payment interface inside a WebView (a built-in browser component), designed to mimic a government portal and collect personal data.

These apps are not isolated threats. They belong to a broader malware family of Android trojans designed to steal financial and personal data while maintaining ongoing access to the device.

Once installed, the malware immediately establishes persistence by running a foreground service (often with a generic name like MyService ), ensuring it continues operating even after the app is closed or the device is rebooted.

From that point, it begins:

Device profiling Collecting information such as device ID, Android version, IP address, carrier, and battery status

SIM and phone data enumeration Gathering phone number, SIM details, and network provider information

SMS harvesting and monitoring Accessing messages and filtering them for financial keywords related to banking, payments, and transactions

This activity happens independently of user interaction , meaning data collection starts even if the victim never completes the phishing form.

This malware family uses a dual infrastructure for communication and control.

Telegram is used as a primary channel for data exfiltration and operator communication. The malware loads embedded bot tokens and chat IDs from its internal resources (such as res/raw/Loda or assets/index.html) and uses the Telegram Bot API to send messages directly to attacker-controlled channels. Through this mechanism, stolen data is transmitted in real time, allowing operators to receive detailed reports that include device information, intercepted SMS messages, and summaries of victim activity.

At the same time, the malware connects to Firebase Realtime Database, which functions as a live command-and-control panel. Through this channel, attackers can remotely interact with the infected device, forwarding incoming SMS messages to their own numbers, sending messages from the victim’s phone, and enabling or disabling call forwarding. They can also push commands and update the malware’s behavior in real time. This setup turns the infected phone into a remotely managed device.

What sets this malware family apart is how it combines multiple capabilities into a single attack chain:

In short, it operates as a hybrid phishing + SMS interception + call forwarding threat , specifically designed to target financial data, mobile banking activity, and user identity information .

Bitdefender Labs researcher Adina Mateescu also identified multiple Android malware samples associated with this campaign, including both droppers (initial installers) and the payload apps they deploy.

Most of the dropped applications use package names designed to look legitimate, such as “com.uptodown,” while others mimic popular apps like “com.baidu.searchbox.lite” .

If you receive a message a toll or parking fine, take a moment to think the following:

Legitimate authorities rarely request payments through unsolicited text messages with embedded links .

Scam texts unpaid tolls or fines have been circulating for years, but their scale is growing rapidly. Authorities across the US have issued multiple warnings, highlighting the extent of the problem. The FCC has received complaints messages impersonating toll services such as E-ZPass, FasTrak, and I-PASS, while the FBI recorded 59,271 toll scam complaints in 2024 alone. At the same time, the Federal Trade Commission reports that consumers lost $470 million to text-based scams in 2024, a fivefold increase compared to 2020. According to the FTC, these types of messages, including toll-related scams, are now among the most common forms of fraud.

If you’re unsure, you can safely check suspicious links or messages using tools like Bitdefender Link Checker or Bitdefender Scamio , which can help you assess whether something is a scam without putting your data at risk.

Because these attacks are designed specifically for smartphones, having protection directly on your device is essential.

A mobile security solution can help reduce the risk by blocking malicious links before they load, detecting scam patterns in messages and websites, and flagging suspicious activity even when links are shortened or disguised. But with campaigns like these constantly evolving, protection isn’t just reacting to threats — it’s also recognizing them early.

Bitdefender Mobile Security includes Scam Radar , a feature built into its Scam Protection layer that focuses on early warning. Instead of waiting for a threat to reach your device, Scam Radar monitors emerging scam campaigns and alerts you when they start spreading, including those targeting your region.

It also provides real examples of scam messages, highlights which brands or authorities are being impersonated, and offers clear guidance on what to watch out for. This kind of context is especially useful for scams involving tolls or parking fines, where familiarity and urgency are key tactics.

Knowing that a scam is already circulating (and what it looks like) makes it much easier to recognize and avoid before you click.