Email · stamped QR PHISHING

The toll bill with a QR code to scanQR PHISHING

A real scam people fell for this year, next to the real thing. The numbers mark the three things to check: hover or tap one to see what it tells you.

Safe
MInbox (3) – Gmail×
https://mail.google.com/mail/u/0/#inbox
✎ ComposeInbox 3StarredSnoozedSent
Your 407 ETR statement is ready
4407 ETR <no-reply@407etr.com>to me10:42 AM

Hi Alex,

Your October statement is ready. Amount due: $18.40 by November 5.

To view or pay it, sign in to My Account at 407etr.com.

ScamQR PHISHING
MInbox (3) – Gmail×
https://mail.google.com/mail/u/0/#inbox
✎ ComposeInbox 3StarredSnoozedSent
Unpaid toll balance: $18.40
4407 ETR <billing@407etr-tollnotice.com>to me10:42 AM

Your 407 ETR account has an unpaid toll balance of $18.40 from trips on Sept 28.

Scan the QR code below with your phone camera to pay.

If not paid within 48 hours, a $45 late fee is added and your plate may be denied at renewal.

QR code: scan to pay $18.40The whole email is one picture

Always check the QR code.

It wants you to scan a code with your phone to pay, so the link skips your computer's checks and you never see where it goes. And the sender isn't 407 ETR.

Always checkThe real oneThe scam
1Where it livesIs it the real company's or person's own address or number?

no-reply@407etr.com is 407 ETR's own address.

billing@407etr-tollnotice.com has 407 ETR in its name, but 407 ETR doesn't own it.

2What it asks you to doCheck firstDoes it want a password, a payment, a call, or a tap?

Sign in to My Account at 407etr.com yourself to pay.

Scan a QR code with your phone and pay there.

3How hard it pushesIs there a deadline, a threat, or a surprise charge?

A due date weeks away.

48 hours, then a late fee and trouble renewing your plate.

RememberNever scan a QR code in an email to pay or sign in. Type the company's address yourself.

Would you have spotted it?

10 pairs like this one, three minutes, a score to share. Then find out who in the family is the easy mark.

Take the testNext scam: The "arnazon" order email →