1 million victims, 17,500 fake sites: Google takes on toll-fee scammers
A Phishing-as-a-Service (PhaaS) platform based in China, known as “Lighthouse,” is the subject of a new Google lawsuit.Lighthouse enables smishing (SMS phishing) campaigns, and if you’re in the US there is a good chance you’ve seen their texts about a small amount you supposedly owe in toll fees. Here’s an example of a toll-fee scam text:
Google’s lawsuit brings claims against the Lighthouse platform under federal racketeering and fraud statutes, including the Racketeer Influenced and Corrupt Organizations Act (RICO), the Lanham Act, and the Computer Fraud and Abuse Act.
Red flags in smishing messages
There are some tell-tale signs in these scams to look for:- Spelling and grammar mistakes: the scammers seem to have problems with formatting dates. For example “September 10nd”, “9st” (instead of 9th or 1st).
- Urgency: you only have one or two days to pay. Or else…
- The over-the-top threats: Real agencies won’t say your “credit score will be affected” for an unpaid traffic violation.
- Made-up legal codes: “Ohio Administrative Code 15C-16.003” doesn’t match any real Ohio BMV administrative codes. When a code looks fake, it probably is!
- Sketchy payment link: Truly trusted organizations don’t send urgent “pay now or else” links by text.
- Vague or missing personalization: Genuine government agencies tend to use your legal name, not a generic scare message sent to many people at the same time.
Be alert to scams
Recognizing scams is the most important part of protecting yourself, so always consider these golden rules:- Always search phone numbers and email addresses to look for associations with known scams.
- When in doubt, go directly to the website of the organization that contacted you to see if there are any messages for you.
- Do not get rushed into decisions without thinking them through.
- Do not click on links in unsolicited text messages.
- Do not reply, even if the text message explicitly tells you to do so.
- Immediately change your passwords for any accounts that may have been compromised.
- Contact your bank or financial institution to report the incident and take any necessary steps to protect your accounts, such as freezing them or monitoring for suspicious activity.
- Consider a fraud alert or credit freeze. To start layering protection, you might want to place a fraud alert or credit freeze on your credit file with all three of the primary credit bureaus. This makes it harder for fraudsters to open new accounts in your name.
- US citizens can report confirmed cases of identity theft to the FTC at identitytheft.gov.