The Journal. - No, Your Toll Payment Is Not Overdue

Episode Date: October 22, 2025

Chinese criminals have made more than $1 billion from scam text messages sent out across the U.S. and the world. The texts warn of unpaid fines and lure unsuspecting victims to fork over their credit-card details. WSJ’s Robert McMillan explains how the scheme works and why it’s been so hard to stop. Jessica Mendoza hosts.  Further Listening: Pig-Butchering: A Texting Scam With a Crypto Twist The Slaves Sending You Scam Texts Sign up for WSJ’s free What’s News newsletter. Learn more about your ad choices. Visit megaphone.fm/adchoices

You know, Bob, right before we got on this call, one of our producers actually just got a text that I want to read to you. Oh. So it says, easy pass, final notice. Oh, Chinese scam. Sorry. Our colleague Bob McMillan covers cybersecurity, and he's been looking into the kind of scam that one of our producers just got fished with. If you fail to pay within 24 hours, we will take the following actions. Report to the DMV violation database, suspend your vehicle registration, and you may be prosecuted. Then there's a

link where you're supposed to pay. Oh, that sounds awful. You better pay that right away. Don't tell people they might actually click it. You may have received some of these texts yourself. A lot of people have all across the country. So I've received several of these text messages telling me I owe $699 to Massachusetts Easy Pass. So just a couple days ago, I get a text message

talking about I need to pay my tollways or my license are going to be revoked at my nearest DMV. I just got this one this morning from the Toll Roads team. Toll Roads' notice of toll evasion. And sometimes it works. The first and last time I really

try to be responsible and pay my toll ways, My dumb ass gets scummed. What is going on? What are these text messages? Where are they coming from? Well, yeah, these easy paths, all the toll scams apparently are, according to the Department of Homeland Security, they're all being run by Chinese organized crime.

I mean, it's like a whole world, technologically advanced, and kind of amazing world. of scams. And how big of a scam is this? Like how widespread? It's a massive scam. The Department of Homeland Security estimated that it's made over a billion dollars so far. I mean, just the fact that everybody who's listening to this has probably received one of these messages, you know, just speaks to the scale of the operation. Welcome to The Journal, our show about money, business, and power. I'm Jessica Mendoza. It's Wednesday, October 22nd. Coming up on the show, the billion-dollar scam that's popping up on cell phones across the U.S. and around the world.

This episode is brought to you by SAP. From pleasing investors to keeping customers happy, it's your job. to make it all happen. Not to worry. With the AI-powered capabilities of SAP, you can streamline costs, connect with new suppliers, and manage payroll,

even when your business is being pulled in different directions to deliver a quality product at a fair price while paying your people with their worth too, so your business can stay unfazed. Learn more at SAP.com

slash uncertainty. You know what's better than the one big thing? Two big things. Exactly. The new iPhone 17 Pro on Tellis' five-year rate plan price lock. Yep, it's the most powerful iPhone ever, plus more peace of mind with your bill over five years.

This is big. Get the new iPhone 17 Pro at tellus.com slash iPhone 17 Pro on select plans. Conditions and exclusions apply. Bob, what got you looking into this particular scam? A couple of weeks ago, the Secret Service made an announcement that was really alarming. They said that the telecom infrastructure around New York was potentially under threat from these devices that they had found in the New York area.

And so I started wondering, what are these devices? Bob quickly learned that many of those devices weren't meant to disrupt telecommunications. They were actually being used to send out spam texts. So a SIM box is what it's called. and it's a black box with like a bunch of antennas on it and a bunch of slots for like little white SIM cards, the things that you put in like a mobile phone when you get a new phone. And each SIM card represents a phone number,

and those cards are just pumping out the spam all the time. All those SIM cards and all those boxes, they make up what's called a SIM farm. And it turns out that SIM farms exist all around the country. So how do these SIM farms work? Who's running them? They're basically pitched as sort of a gig economy job. Like the criminals will give you one of these boxes.

You just plug it in in your home. Wow. You get it on your wireless network. And so you're basically a spam pumping operation, you know, at that point. The neat thing that the SIM boxes do is they allow somebody in China to connect to that box and then to send a bunch of messages from all these different phone numbers. Got it. And so those texts about fake over.

overdue tolls, these SimFarms turn them out. Okay, so if I did click on the link, what happens next? What happens next in my journey? Okay, yeah. So you would click on a link and you'd be presented with a very legit-looking website on your phone and it asks you for your credit card information to pay the fee. So you put in your credit card number, expiration date, all this stuff. every number as it's coming gets entered into this software that is on the other side of the fake

phishing website that you're entering your credit card information into. So in China, the person is seeing your credit card numbers as you enter them. And then there's one thing that pops up that's a little bit weird. It says your bank's going to send you a one-time passcode. You need to enter it here for this transaction to go through. Those one-time pass codes, banks send them to verify your identity. So you enter your one-time passcode and somebody at live is just typing that into this phone and now your credit card number is in a Chinese scammer's iPhone wallet. That's wild. And by giving the scammers that one-time passcode, you've told your bank that the criminal's phone is a trusted device. Now, the scammers are free to use your credit card as they wish. But the

problem is, they can't then just go shopping in China. The credit card company would refuse the charge and flag it as fraudulent. To solve for that, these criminals came up with software that can share a digital wallet with another mobile phone, kind of like mirroring the information. Okay, so I type in my credit card information, I give them the one-time passcode. They're then able to put my credit card in their wallet, their mobile wallet in China. Yeah. And then the software allows them to share that with somebody else? Yes, anywhere in the world. Yeah, that's right, yeah.

That's nuts. It's crazy, yeah. The criminals then use special software that lets the credit card that's stored in their digital wallet in China be used at cash registers half a world away, in the U.S. or elsewhere. Those operatives, called Mules,

are recruited on platforms like WeChat, according to Bob's reporting. They have about four to five hundred, mules all around the United States who are walking around with these Android phones and they get the tap from China and they go to a point of sale system in California and they buy a gift card, $100 gift card. And then they buy a second gift card. And then they just keep using them until they stop working, right?

Tap to pay, tap to pay, tap to pay. Until they're maxed out, essentially. Yeah, like dozens of gift cards easily. we found a complaint about someone who just pled guilty to fraud charges who had like 100 and more than 100 gift cards in their possession when they were arrested. So they just basically will take one credit card, tap it and buy a gift card. Often it's an Apple gift card or it could be a luxury good gift card by a second one, buy a third one until the credit card stops working and then they go to the next card in the Apple wallet.

These mules use those gift cards to buy actual stuff, often luxury items like designer handbags and electronics, which the gangs then resell, sometimes in the U.S., but a lot of their haul actually gets shipped over to China. How lucrative is this? It seems like a lot of work for, you know, essentially you're like having to still buy the items and then resell them. It's like a lot.

Yeah, I mean, the converting the stolen credit card, to cash, does seem like a lot of work. And that's where Chinese organized crime really, really shines, is they can get people to do stuff for not a lot of money. They have ways of selling this stuff when it's in China. So I do think, you know, I don't know what their profit margins are like, but to make a billion dollars from this scam is pretty remarkable. And that's a very low range of the estimate. I've talked to researchers who think the amount that that's been made in this scam could approach $30 billion. Wow.

And it might even be more than that. How many people who get these text messages actually fall for them? I don't know. The Chinese spammers are not super public about how... They don't share their data? The metrics, you know. And it doesn't need to be a high click-through rate. Like, you know, it's probably less than 1%.

And we know that... You know, according to the self-reported statistics from the federal government, the average loss around these spam text messages is around $1,000. Wow. But if you send out, like, you know, hundreds of millions of spam messages, then that adds up. Coming up, can anyone stop this billion-dollar scam? At Desjardin, we speak business. We speak startup funding and comprehensive game plans.

We've mastered made-to-measure growth and expansion advice, and we can talk your ear-off about transferring your business when the time comes. Because at Desjardin business, we speak the same language you do. Business. So join the more than 400,000 Canadian entrepreneurs who already count on us, and contact Desjardin today. We'd love to talk, business. For this text scam to work, it has to go through a host of different players at each step of the process, starting with telecommunications companies.

According to Bob, these companies could shut down some SIM farms. They can spot them on their networks, and they could definitely do a better job of just preventing them from being an operation. Like I talked to a researcher who identified 200 SIM boxes just using tools that he had at his disposal, which are not as good as the Telco's tools. And he found like 200 of these SIM boxes around the United States. He knew what cities they were in. So the Telcos could put some pressure on the operators of these spam faucets in the United States, make it more expensive for them to operate, to shut them down,

more quickly, work with law enforcement to seize the equipment. In an email, a wireless telecommunications industry group, known as CTIA, said, quote, the wireless industry works both individually and collaboratively with law enforcement every day. Another player that could potentially stop these text scams are the phone makers. Google, for example, has added AI detection tools in its Android platform to warn users of scammy messages. So we've been talking about tech solutions here, but all of this is happening through stolen credit cards, right? What are the credit card companies and banks doing to stop these scams?

I mean, the easiest solution here is at the point of payment, the phones do transmit information about the device that's being used to initiate the point-of-sale transaction. And so in this case, the banks could be better about doing, risk analysis given that information. For example, say I use an iPhone 11 and then suddenly there's a transaction coming from an iPhone 10, you know, on my Apple wallet. Like, okay, something's changed there, right? So, you know, if you flag that, it's suspicious. Like, there are breadcrumbs in these, in these Apple Wallet transactions that the banks could be better at identifying. Banks are in a tricky spot. They want to prevent fraud, but they don't want to create friction

for customers. They're running this tension because if they reject too many transactions, if they're too tough on this, then people won't want to use their credit cards, right? So they have to walk this line between ease of use and security, and they have to get it right. Because if you're legitimately trying to buy something and your stupid credit card isn't going through because, you know, the bank thinks you're a Chinese scammer and you're not, like, that's super frustrating. So telecom companies and banks haven't solved the scam problem.

And on the law enforcement side of things, stopping the people involved has been slow going. They can bust the mules and they're doing that. But it's tough because, you know, there are just so many of them and they're so easily recruited and, you know, that's a problem. Has anyone in China been busted yet? No. The United States doesn't have the ability to extradite people from China. So even if we had identified the criminals there, China would not ship them to the U.S. for prosecutors. Even as law enforcement gets a better understanding of these text message scams, the fact is criminals are constantly innovating and changing tack.

They've always got a new scam. So what does all of this say about the state of scamming today? It's global, it's extremely lucrative, it's not going to stop. I mean, the fact that the people doing this can't be extradited, you know, there's a couple of places. that a lot of bad things come out of. And they're regions of the world where the United States just can't, you know, law enforcement just can't touch people.

So if there's something that you want people to remember, is it just like, don't click the link? Don't do it. Yeah, obviously, yeah, be careful what you click, for sure. But also, anytime, this is what I tell people, Anytime you find yourself reaching for your wallet with a sense of, like, urgency, like, I need to get this done quickly because of whatever the consequence might be. Stop. Just take a breath, you know, and ask yourself, is this a scam?

That's all for today. Wednesday. day, October 22nd. The Journal is a co-production of Spotify and the Wall Street Journal. If you like our show, you can find us on Spotify or wherever you get your podcasts. We're out every weekday afternoon.

Thanks for listening. See you tomorrow.