Drivers across the UK and abroad are being warned about a fast-growing wave of scams targeting them. Smishing campaigns involve criminals impersonating toll operators, parking services, or even police and enforcement agencies. The scammers aim to trick recipients into clicking links, paying fake fines, handing over personal or banking data, or installing spyware.
Global Scale of the Threat
Bitdefender Labs has been tracking this activity since late 2025, reporting tens of thousands of messages and more than 30,000 scam links across the UK, US, Canada, Ireland, Australia, New Zealand, France, Spain, Luxembourg, Colombia, Brazil, and India. Messages arrive in multiple languages and often appear convincingly official.
How the Scams Work
These scams are designed to convince recipients that they are genuine payment requests, making them easy to fall for. The sender names are often spoofed to resemble legitimate messages you may have received. Even the links and websites can be crafted to mimic official portals, making it hard to distinguish real from fake.
In some instances, messages ask for a reply before sending a link. By replying as requested, you can inadvertently bypass built-in link protection services on many mobile devices.
Red Flags to Watch For
While many features of these campaigns may appear genuine, there are telltale signs that indicate a message is a scam. The amounts requested are generally small, with tight payment deadlines that pressure you to pay quickly and reduce time for consideration. This urgency may be accompanied by threats of additional fees, legal action, or even arrest if payment is not made on time.
First, consider whether you or someone with access to your vehicle could have genuinely incurred the charge. Is it from a place you know or have recently visited? If not, that is a warning sign. Additional red flags include:
- Unsolicited fine or toll texts with short payment deadlines and severe consequences.
- Links that are shortened, unfamiliar, or contain 'gov/official' in non-government domains.
- Requests to reply before tapping a link, or instructions that feel unusual.
- Texts that appear inside an existing brand thread but ask for new or urgent actions.
- Payment pages that look slightly off, ask for full card and personal details, or only accept unusual methods.
- Prompts to install an app to 'view' or 'pay' a fine, especially from outside your app store.
- Misspellings, odd spacing or characters, and inconsistent branding.
What to Do If You Think You Have Been Scammed
If you suspect you have been caught out, stay calm and take the following actions to minimize potential risk:
- If you entered card or bank details: Contact your bank immediately. Freeze or replace cards, enable transaction alerts, and monitor statements.
- If you logged into online banking: Change your password from a different device, enable two-factor authentication, and alert your bank's fraud team.
- If you installed an app: Put your device in airplane mode and uninstall the suspicious app. On Android, also review and revoke unusual permissions (Accessibility, SMS, Phone, Device Admin).
- Run a reputable mobile security scan. Update your OS and apps to ensure you have the latest security patches.
- Change passwords for accounts accessed on the device, prioritizing email, banking, and cloud storage.
- Check call/SMS forwarding rules in your phone and messaging apps; remove anything you did not set up.
- Preserve evidence (screenshots, URLs, timestamps, bank notifications) for your bank and a police or regulatory report.
- Forward the message to 7726 and report to Action Fraud. Block the sender and delete the message after reporting.
Preventive Steps
Prevention is always better than cure. Take the following steps to reduce the chance of being caught out. If you suspect you have received a scam message, do not click the link, do not reply, and do not call any number in the text.
- Go straight to the source: Access tolls, parking, and government services via official apps or URLs you have saved, not links in messages.
- Call the agency using a number from its official website, not the one included in the message.
- Check your email or postal mail for legitimate notices. Official portals rarely demand payment only by text.
- Lock down installs: Only install apps from official stores. Disable 'install unknown apps' on Android.
- Keep devices current: Update your OS and apps; enable Play Protect (Android) and review security settings periodically.
- Educate your circle: Family members, especially new drivers and seniors, are frequent targets.
These scams succeed by borrowing trust through official names and government language, and imposing urgency. Slowing down and verifying through known, official channels is your best defense. If a message demands fast payment via a link, treat it as hostile until you can prove otherwise.
