WSDOT Text Phishing | Fake Toll Request

Did you receive a text message that says you have an outstanding toll? Don’t pay it with the text link, go to the website directly… it could be a phishing attempt. In general you won’t receive texts for these organizations, but some do. So be aware.

The sender could be something like: “corrinepaucekhcas@outlook.be” for iMessage users or a random phone number. The text (SMS) could be something like this:

WSDOT Final Reminder:
You have an outstanding toll.Your toll account balance is outstanding. If you fail to pay by March 17, 2025. You will be penalized or subject to legal action. Now Payment: https:// mygoodtogo . com-serviceny. xin/pay (Please reply Y, then exit the SMS and open it again to activate the link, or copy the link to your Safari browser and open it) Please settle your toll immediately after reading this message to avoid penalties for delaying the payment. Thank you for your cooperation.

This message is a phishing scam designed to trick you into giving away personal or financial information. If you open the link you’d be surprised it looks identical to the actual (mygoodtogo) website, because they cloned it. Here’s how it works and why it’s a hack attempt:

1. Fake Link with a Deceptive Structure

• The official Washington State Department of Transportation (WSDOT) toll payment site is mygoodtogo.com

• The scam link, mygoodtogo.com-serviceny.xin, is not a real .com website

• The actual domain is .xin, meaning the scammer registered a domain ending in .xin and created a subdomain named “mygoodtogo.com-serviceny” to make it look legitimate

There is no real dash after .com instead, the entire part before .xin is just a subdomain, making it appear like a real “dot-com” site.

In mygoodtogo.com-serviceny.xin, the subdomain is:

mygoodtogo.com-serviceny

Breakdown:

• The real domain (second-level domain + top-level domain) is: xin

• The part before .xin (mygoodtogo.com-serviceny) is a subdomain of xin, not an actual .com website

How it deceives you

• Most people see “mygoodtogo.com” at the beginning and assume it’s legit

• But the real website is on .xin, not .com

• The dash after “com” is just part of the subdomain name, not a real .com domain

Scammers use this trick to mimic real websites. Always check the last dot before the top-level domain to see the real site.

2. Urgency and Threats to Pressure You

• The message falsely claims you have an outstanding toll and threatens legal action if you don’t pay immediately

• Scammers use urgency to make people panic and act without verifying

3. Unusual Activation Process

• The message asks you to reply “Y” and reopen the SMS to activate the link

• This is a trick to bypass security filters on your phone that might block malicious links

4. Grammar and Formatting Issues

• “Your toll account balance is outstanding” is repetitive and unprofessional

• Official government messages are usually well-written and formatted properly

How to Protect Yourself

Do not click the link or reply

Manually visit the real website by typing mygoodtogo.com in your browser

Check the domain carefully the real one ends in .com, not .xin

Report the scam to WSDOT and your mobile provider

Block the sender to avoid future messages

This type of scam is common and designed to steal login credentials or payment details. Always verify before making any payments online!

Oops I clicked the link!

Did you click the SMS (text) link by mistake? If you clicked the link by mistake, follow these steps immediately to protect yourself:

1. Close the Page Immediately

• If the site asks for login credentials or payment information, do not enter anything

• Simply exit the browser tab

2. Clear Your Browser History and Cache

• On your phone or computer, go to your browser settings and clear history, cache, and cookies

• This prevents the site from tracking you or storing any session data

3. Scan for Malware

• If you clicked on the link from a computer, run a malware scan using Windows Defender, Malwarebytes, or another security tool

• On a phone, check if any unknown apps were installed (unlikely, but good to verify)

4. Monitor Your Accounts

• If you didn’t enter any details, you’re likely safe, but keep an eye on your bank accounts and email for any unusual activity

5. Change Your Passwords (If You Entered Any Info)

• If you accidentally entered your Good To Go account login, change your password immediately on the real site

• If you entered credit card details, contact your bank to freeze the card and issue a new one

6. Report the Scam

• Forward the message to 7726 (SPAM) to report it to your carrier

• Report the phishing attempt to WSDOT and your bank if needed

If you just clicked but didn’t enter anything, you’re likely safe, but it’s always good to be cautious!

Zenia
follow
Latest posts by Zenia (see all)

Leave a Reply

Your email address will not be published. Required fields are marked *

2 + 4 =
Powered by MathCaptcha

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Categories

Top Posts

1

2

3

4

5

connect