LIVE: New phishing campaigns targeting mobile users —View latest threats →

Back to Threats
High🎣 PhishingNEW

ASFINAG Fake Toll Fine SMS Scam (Austria)

Smishing scammers impersonate ASFINAG via SMS to claim a fake toll or parking fine, luring Austrian drivers to a phishing site that steals payment card data.

Published: 25 June 2026

What Is This Threat?

A smishing (SMS phishing) campaign is actively targeting people in Austria. Victims receive a text message from a contact saved or displayed as "Parkstrafe" (parking fine), claiming they have an outstanding balance that must be paid immediately or a reminder fee ("Mahngebühr") will be added.

The message links to a fraudulent domain impersonating ASFINAG — Austria's official motorway and expressway financing company (Autobahnen- und Schnellstraßen-Finanzierungs-Aktiengesellschaft).

The Scam Message (Real Example)

Parkstrafe — SMS received 14:22

>

"Bitte begleichen Sie Ihren ausstehenden Betrag so schnell wie möglich. Andernfalls erheben wir eine Mahngebühr. Details: https://asfinag.dmliwmwa.eu.cc/at"

>

Translation: "Please settle your outstanding amount as soon as possible. Otherwise we will charge a reminder fee. Details: [link]"

Why It's Convincing

  • Uses ASFINAG — a well-known, trusted Austrian authority — in the URL to appear legitimate
  • Applies financial urgency: threat of additional fees creates pressure to act fast
  • Sends from no specific number — the sender name "Parkstrafe" (parking fine) makes it look official
  • Targets mobile users who may not inspect URLs closely on small screens

    • How to Spot the Fake Domain

    The real ASFINAG website is asfinag.at. The scam URL asfinag.dmliwmwa.eu.cc/at reveals multiple red flags:

    | Indicator | Scam URL | Legitimate |

    |---|---|---|

    | Real domain | dmliwmwa.eu.cc | asfinag.at |

    | TLD | .eu.cc (free, abused) | .at (Austrian official) |

    | ASFINAG position | Subdomain prefix only | Actual domain owner |

    | Path | /at (geo-targeting trick) | N/A |

    The .eu.cc TLD is a free subdomain service frequently used by scammers because it allows anyone to register anything.eu.cc instantly and anonymously.

    What Happens If You Click

  • You are taken to a convincing fake ASFINAG payment page

  • The page asks for your name, vehicle plate, and payment card details
  • Your credit/debit card data is immediately stolen
  • Some variants also attempt to install tracking software or steal credentials

    • Red Flags Checklist

  • ❌ No specific fine amount, date, or vehicle registration mentioned
  • ❌ Sender is just "Parkstrafe" — not an official government number
  • ❌ Domain is dmliwmwa.eu.cc — not asfinag.at
  • ❌ Urgency language without any official reference number
  • ❌ Austrian authorities never demand payment via anonymous SMS links

    • How to Protect Yourself

    • Never click links in unexpected SMS messages about fines or fees
    • Always verify tolls and fines directly on the official ASFINAG website (asfinag.at)
    • Check the full URL — the real ASFINAG domain ends in .asfinag.at, never .eu.cc or similar
    • Official Austrian authorities always include a reference number and your vehicle plate in communications
    • Enable spam/scam filters on your mobile device
    • Forward suspicious SMS messages to your carrier's spam reporting service

    What to Do If Affected

    1. 1.Do NOT click the link — close the message immediately
    2. 2.If you already clicked but did not enter data, you are likely safe — clear your browser cache
    3. 3.If you entered payment details, contact your bank immediately to freeze your card
    4. 4.File a report with the Austrian police (Polizei.gv.at) and Watchlist Internet (watchlist.at)
    5. 5.Forward the SMS to the Austrian consumer protection agency
    6. 6.Check your bank statements for unauthorized charges over the next 30 days
    #SMS#smishing#ASFINAG#Austria#parking fine#toll#Parkstrafe