Listen to the episode
TLDR
CSIRT Italia has detected a widespread phishing campaign via WhatsApp that exploits the theme of unpaid highway tolls. The victim receives a link that redirects to a clone page of Autostrade per l'Italia, where they are asked to enter the...
How it works
CSIRT Italia has detected a widespread phishing campaign via WhatsApp that exploits the theme of unpaid highway tolls. The victim receives a link that redirects to a clone page of Autostrade per l'Italia, where they are asked to enter the...
Red flags
- Urgent pressure to click, pay, or share codes immediately.
- A link or sender that does not match the official organization.
- Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What to do
- 1Red flag Unsolicited WhatsApp message announcing a failed automatic charge and threatening sanctions Clone site of Autostrade per l'Italia with a suspicious domain, reachable only via the received link Request for complete card details (PAN, CVV, expiry) on an unverifiable "Secure Payment" page What to do Access the official Autostrade per l'Italia website by manually typing the address in the browser, never through received links Be wary of urgent payment requests for small amounts accompanied by threats of sanctions or imminent deadlines Contact the bank immediately and block the card if the data has been entered on a page
Source
csirt-italia
Source reviewed by Mythos Forensic Team
https://www.acn.gov.it/portale/w/campagna-di-phishing-a-tema-mancato-pagamento-del-pedaggio-autostradale-FAQ
Is WhatsApp phishing on unpaid highway toll: how to recognize it a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What should I do first?
Red flag Unsolicited WhatsApp message announcing a failed automatic charge and threatening sanctions Clone site of Autostrade per l'Italia with a suspicious domain, reachable only via the received link Request for complete card details (PAN, CVV, expiry) on an unverifiable "Secure Payment" page What to do Access the official Autostrade per l'Italia website by manually typing the address in the browser, never through received links Be wary of urgent payment requests for small amounts accompanied by threats of sanctions or imminent deadlines Contact the bank immediately and block the card if the data has been entered on a page
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.