The latest warnings in recent days come from Virginia, New York, Florida, California and the FCC, which told drivers “toll operators typically don’t use text messages to collect on overdue accounts, and do not use threatening language to rush customers into action.”

That’s an understatement. If you get an unpaid toll text, you should assume it’s an attack. Every time. If you have concerns you may owe a toll, contact the operator using its usual, publicly available channels. Then do as the FBI says and delete the text.

And you should get used to these attacks. They’re not stopping. The next wave is expected to move from tolls to banking, with texts pretending to be from financial institutions instead of toll operators or delivery services.

That’s unsurprising. In a new report, Gen, the company behind such brands as Norton and Avast warns that “mobile financial threats continued to rise, fueled by increasingly sophisticated tactics that target people directly through their smartphones. Malware, like banking trojans, now exploit accessibility features to overlay fake login pages, stealing sensitive data such as crypto wallet credentials. Combined with an uptick in credit and transaction fraud alerts, there’s a growing trend of attackers focusing on mobile devices as gateways to people’s financial lives.”

Resecurity was first to warn that the Chinese OCGs are preparing to turn to the financially sector next, and that “the actors behind smishing campaigns are tightly connected with those involved in merchant fraud and money laundering activity. Smishing is one of the main catalysts behind carding activities, providing cybercriminals with substantial volumes of compromised data collected from victims.”

Resecurity warns just one threat actor can send “up to 2,000,000 smishing messages daily,” which means targeting “up to 60,000,000 victims per month, or 720,000,000 per year, enough to target every person in the U.S. at least twice every year.”

The hope now is that these warnings are being amplified loudly enough for all U.S. citizens to be alert to unpaid toll texts. The Michigan Department of Transportation has even taken to warning of toll scams using the electronic traffic signs along its highways. And it’s not ambiguous: “Be aware,” it warns, “toll texts are scams.”

Louisiana’s Office of Motor Vehicles has just warned its drivers in equally blunt terms: “The @LouisianaOMV does not send text messages or emails threatening to suspend your vehicle registration or driving privileges. If you receive such a message: Do NOT click links; Do NOT respond; Delete the message; Report the scam.”

Meanwhile, Utah’s DOT has again told state drivers “THIS IS A SCAM. We do NOT send texts or make phone calls to collect tolling fees, and urge anyone that receives a message about an outstanding toll balance to not provide any payment information.”

In a new advisory, Google warns this is “a global threat, we’ve observed that attackers will ‘follow the sun’, first sending scam messages mimicking toll roads in Europe, then in the East Coast of the U.S., then in the West Coast, and onwards over the course of a day. These messages aren’t always the most realistic — our teams have seen cases where users are spammed with toll road fees in states that don’t operate toll roads.”

While there are telltale signs — such as Chinese top level domains such as .TOP or .XIN in links or the subtle use of a “com-” to mimic a real .COM domain, staying safe is simpler. Assume any undelivered package, unpaid toll, compromised password, suspended account or similar is a scam. Never reply. Never engage. Always delete.

And that applies to any such text scam. The unpaid toll ruse is expanding to include wider traffic offences. Per one user on X who shared one such text, “The tollway text scam has evolved into a DMV text scam. I was warned about this at the national level in the news last week. Don’t click any links and delete it!”

The text itself, which purported to come from the Illinois State Department of Motor Vehicles (DMV), warned that “our records show that as of today, you still have an outstanding traffic ticket.” The notice threatened to “suspend your vehicle registration starting May 29, “suspend driving privileges for 30 days” and that “you may be prosecuted and your credit score will be affected.”

The link is typical of such attacks. “https://illinois.gov-spju.xin/pay” includes a “.gov” to trick a user into thinking it’s legitimate, but with a “-”and another word before an unsurprising final “.xin,” which is a Chinese top level domain.

This is an industry operating at almost unimaginable scale. You can’t play against this one text at a time. Make some hard and fast rules for yourself, and do not click on any links regardless of how compelling a lure these gangs and their AI might concoct.