The Road Traffic Infringement Agency (RTIA) is investigating a possible hack of the eNatis system, as scams using propaganda tactics of fear and reward are being distributed under ‘Fines SA’ branding and listing the motorists’ correct number plates.
The RTIA has noted a “sharp increase in sophisticated scams”. It says criminals are using cloned payment portals, SMS, WhatsApp and e-mail to steal money and personal information.
Fines SA, meanwhile, says its system has not been breached, and the cyber thieves are impersonating it.
The increase in scams comes just months after the RTIA rolled out the second phase of the Administrative Adjudication of Road Traffic Offences Act (AARTO), which is now live in 62 municipalities, although the demerits system will only be introduced next year.
RTIA spokesperson Monde Mkalipi tells ITWeb that the agency is consulting its legal services team about a potential investigation to determine how scammers might have accessed a vehicle database.
“What is worrying is that they’ve got the correct registration number of the people’s vehicles,” he says, speaking to the fact that scammers might have illicitly accessed the electronic National Traffic Information System (eNatis).
Digging deep
Mkalipi says the authority does not yet know how the scammers obtained the information and aims to “get to the bottom” of how scammers might have gotten “hold of that”.
The RTIA is currently gathering information and seeking to bring other stakeholders into the process, aiming to make an announcement in the next few days. “We are in an information-gathering exercise as we speak now.”
While the scammers appear to have access to some accurate data, not all the information is legitimate, says Mkalipi. He points to the purported infringement notice numbers used in the scams, saying they do not follow the format used for genuine notices.
“Every AARTO infringement notice comes with a 16-digit infringement notice number to it. They either start with a 01, 02, 03, 04, 05,” Mkalipi says. These messages, conversely, have numbers such as “2394 2450 1141 5674”.
Mkalipi adds that the scammers might be aware motorists have incurred an infringement. “So, they do have this information in one way or the other.”
Linking up
Screenshots supplied to ITWeb by the RTIA show scam messages using Fines SA branding and containing motorists’ actual vehicle registration numbers, purported infringement details, demerit points and discounts.
One notice claims the motorist was travelling at 74km/h in a 60km/h zone and offers a 50% “early settlement” discount, reducing the supposed R500 penalty to R250. Another carries a different registration number but alleges the same speeding offence.
Under the Act, motorists genuinely have a 32-day period to take advantage of a 50% discount before it falls away and the fine starts being escalated through the system. The RTIA notes the fake messages are often timed to coincide with paydays and threaten to block a driving licence card or vehicle licence disc.
Barry Berman, Fines SA CEO, says motorists are “really on edge”, creating an environment in which an apparently legitimate message offering a 50% discount can be particularly effective.
“They’re all getting hit, you know, because there’s this change in the system. People are confused as it is,” Berman adds. “People are in a rush; they just want the problem solved. They see a 50% discount and it’s tempting to just pay.”
The payment service sends customers a statement once a month and includes scam warnings in its communications, while the RTIA is encouraging people to check the official website.
Berman says Fines SA regularly warns its more than two million users about evolving scams across its communication channels and reports identified phishing links to Google. “We at Fines SA take these scams very seriously, as they are a threat to our business and the integrity of the traffic fine system in SA.”
Fines SA conducts penetration testing and has an external cyber security team monitoring its technology around the clock, says Berman, noting that other traffic fine services are also being targeted.
Old tricks
Earlier phishing e-mails examined by ITWeb show how scammers previously disguised their origins while impersonating the RTIA.
One received in June threatened to block vehicle and driving licence renewals unless R420 was paid within 24 hours. Although displayed as coming from the “RTIA Adjudication Office”, analysis of the original e-mail by ChatGPT found the actual sender used a German domain unrelated to the authority.
Its payment button directed the recipient to a subdomain belonging to an unrelated South African business. The URL was constructed using terms including “rtiaroad”, “traffic-infringement” and “agency”, followed by the same purported enforcement order number contained in the e-mail.
“The important part is the registered domain. Attackers can place convincing words, brand names and even a victim-specific reference number before it to make a phishing address appear legitimate,” ChatGPT says.
ITWeb contacted the business to establish whether it was aware its domain had been used and whether its website, hosting environment or DNS infrastructure had been compromised. The company had not reverted as of the time of writing and, as a result, ITWeb has withheld its identity.
“None of these indicators individually establishes how the unrelated business’s domain came to be used,” ChatGPT says. “It could indicate compromised web or DNS infrastructure, but that would need to be confirmed by the domain owner or hosting provider.”
Share
