I think everyone who has a cell phone has probably gotten the Toll Pass scam, but I still wanted to talk about it just in case. It also gives me an opportunity to show how to identify scams.
Here is a screen capture of a very long text I received where I supposedly did not pay my tolls.
The first obvious scam indicator is the +63 country code. Why would I be getting a notice about tolls from a Philippines area code? If the toll systems even had my phone number (which they don’t!), I’m sure the text would come from a US area code.
Now look at the URL they give: dmvca.mv-govng.win
On first look you see dmvca which could mean the Department of Motor vehicles in California. It’s trying to fool you though and I’ll show you how.
A web address is often just two parts: yahoo.com
Yahoo is the “domain” name and .com is the “domain extension”. If I type www.yahoo.com, the www means I want to go to the web portion of Yahoo. To get to Yahoo’s email, I can type mail.yahoo.com. That mail beginning part (called a “sub-domain”) is a specific location in Yahoo.com.
Back to the toll pass scam example. The .win is a domain extension usually used by betting websites.
The website domain name is mv-govng. The full website is mv-govng.win.
And then the subdomain they created, dmvca, is meant to trick you into thinking it’s the real California DMV. Thus dmvca.mv-govng.win is a real website location, but specifically built to scam you.
Scams are usually around for just a few hours or days before they are moved. When I pasted mv-govng.win into the Bitdefender link checker, it shows the website is safe.
I then tried to go to the website directly and it wouldn’t show anything (it said there was no data). The scammers had removed the website data, but they still own the website.
For curiosity, I went to the official international registration organization for URLs, called ICANN, and did a “lookup” to see more about the domain.
The mv-govng.win domain was bought/created on May 23rd, the same day I received the text.
The other information in the domain registration is gibberish and the additional suspicious information is that the registrar is out of Hong Kong (not the US or even the Philippines).
So remember, every text you get from someone you don’t know could be a scam or threat. Look at the following every time:
- Phone number – even real phone numbers can be “spoofed” so that it may appear to come from the real company.
- Links – always be suspicious!
- Sense of urgency – see how they said I had to do something by the next day or my license would be suspended.
Be your own detective the next time you get a text. It can be fun!