Attacks on iPhone and Android users surged more than 700% this month, with malicious texts targeting multiple cities and states. Following alerts from police forces across the country, the FBI has now confirmed the latest warning and stepped in. This threat comes directly from China, and you need to delete all these texts immediately.
As I reported earlier this week, the infamous unpaid toll texts that have plagued American smartphone users for more than a year “have seen a significant decline recently. But the DMV texts that have replaced them are “more threatening.”
That’s the warning from Guardio, whose researchers have been tracking these attacks for months. Its team “spotted a 773% surge in DMV scam texts during the first week of June,” which shows no signs of slowing. “These scam texts lead to phishing websites designed to steal people’s credit card information and make unauthorized charges.”
Now the FBI has confirmed it is investigating the DMV scam. According to FBI Tennessee’s Supervisory Special Agent David Palmer, the unpaid toll cybercriminals have “pivoted to the DMV scam.” Confirming the gangs operate from overseas, Palmer warns these texts can “put malware on your phone, which then can go in and steal information from your device, or collect your payment information.”
Palmer warns smartphone users “if you don’t know who [a text] is from, don’t click the link.” Those links use domains crafted to trick users into thinking they’re legitimate. As Guardio explains, “scammers generate a new domain for almost every DMV text. The format is usually the name of a state followed by a generic domain. Sometimes they include ‘.gov’ as part of the URL to make the website appear legitimate.”
There will be millions of these texts sent out over the coming weeks and months. As Resecurity warns, “just one threat actor can send “up to 2,000,000 smishing messages daily,” which means targeting “up to 60,000,000 victims per month, or 720,000,000 per year, enough to target every person in the U.S. at least twice every year.”
Just as with undelivered packages and unpaid tolls, the FBI’s advice is to “delete any smishing texts received.” You don’t want the dangerous links left on your phone, even though many are only active for a few hours before they’re detected and blocked.
The new DMV attacks go beyond the late payment lure with the toll texts, these cite a non-specific traffic offense and threaten suspensions of driving licenses and vehicle registrations. They create a sense of panic and urgency to push users to engage. Don’t. Every one of these texts is a scam. If you have any doubts, contact your DMV using public channels. You can report the text. But you must delete it
