DENVER — Clint Bales usually avoids toll roads, but on a trip with his wife last month, he found himself in the C-470 Express Lane.
"I probably wasn't paying close enough attention," said Bales, who owns a landscaping company and drives all over the Denver metro area. "I quickly exited the express lane, but I probably shouldn't have because there was a solid white line. I knew I had made some kind of mistake and was going to hear about it."
The next day, he received a text with a link to pay his bill. The text read, "EZ Pass Final Reminder. You have an outstanding toll."
"I thought it was related because of the timing," he said. "Up came the information about my truck, that it was a 1500 pickup, my license plate number. This passes the sniff test for me, I'm going to go ahead and pay this fine."
An hour later, he received an email confirming his credit card had been enrolled in Apple Pay, which he had not authorized.
"When I went back to the fraudulent website where I supposedly paid my toll, it wasn't there anymore," Bales said."Yeah, just completely taken down. My bigger worry was that perhaps the CTIO had been hacked or something."
Bales became the latest victim in a text message scam sweeping the country, including Colorado.
E-470 issued a scam alert with examples of what the texts can look like, and while Colorado officials have warned about fraudulent toll texts, people who have fallen for the scam tell Denver7 Investigates that more could be done to protect consumers.
"Scams like this one are getting more sophisticated all the time because they're getting information that's actually about you," Colorado Attorney General Phil Weiser said, adding that his office has received dozens of complaints about toll road texts.
Last month, the cybersecurity firm Palo Alto Networks reported that a "threat actor" registered 10,000 domains for smishing scams impersonating toll and package delivery services.
"So even if they say something that is true about you in one of these texts or maybe an email or a voicemail, you can't take the bait," said Weiser. "Take a beat, take a breath, and then make sure it's real."
In a statement to Denver7 Investigates, E-470 said, "Our security systems are continuously monitored, and customer information remains secure."
An E-470 spokesperson added that the agency is taking steps to spread awareness about the scam, including warnings on its Expresstoll.com, the E-470 phone system, and on message signs on the roadway, as well as public outreach. As a result, E-470 said the number of calls about scams has dropped in the past two weeks.
"I want other drivers to be aware that this is happening," said Bales, who believes the state and E-470 could do more to warn people about these texts.
Ultimately, Bales had to cancel his credit card, and a real ticket came in the mail the next week for exiting the express lane incorrectly.
"I want people to know that this is happening and that it could happen in close proximity to an actual traffic infraction, and you might take it seriously like I did," he said.
E-470 and Express Toll do not send text messages requesting payment. If you receive a message about an unpaid toll or fine, delete it immediately, do not reply, and do not click on the links.
E-470 said the only safe way to pay your toll is by logging in at Expresstoll.com or reviewing a mailed statement sent to your address on file with the DMV.
If you believe you have been a victim of a phishing scam, file a complaint at stopfraudcolorado.gov.
