AI-driven RingGo text scam targets drivers' bank details
A sophisticated phishing campaign is using artificial intelligence to clone parking apps and bypass Apple's security filters, highlighting a growing threat to consumer finance.
Criminals are circulating fraudulent text messages impersonating the parking service RingGo to harvest bank details and login credentials. The messages claim a "routine review" or "billing review" identified an outstanding parking charge. They threaten recipients with further financial charges and administrative action if they do not settle the debt promptly via an embedded link.
This campaign underscores how advances in artificial intelligence are lowering the barrier for digital fraud, posing a systemic risk to consumer banking. Scammers use the technology to quickly build convincing clones of legitimate corporate websites. "The link is key because it sends you to a counterfeit page that almost mirrors the real RingGo site," said Graham Conway, managing director of Select Car Leasing. "If you then put in your username, password or card details, it goes directly to the criminal gangs, who can drain accounts or sell on your personal information."
The fraud also demonstrates how criminals are actively engineering their way around mobile security filters. Serpil Hall, a security expert at Datos Insights, noted the scam specifically exploits Apple's iMessage protocols by instructing users to reply "Y" to the text. "The moment someone replies, even with a single letter, iMessage reclassifies the sender as known, and the link becomes active," she said. "The scammers are not guessing at this – they know the mechanics and are engineering around it deliberately."
Parking applications are highly effective vehicles for this type of fraud. Drivers frequently struggle with app crashes or poor mobile signals, making an unexpected fee seem plausible. "Parking payment services are a well-worn target because the notification is plausible to almost any driver, the amounts involved are small enough not to trigger immediate scepticism, and there is a genuine sense of consequence attached to ignoring it," Hall said.
The fraudulent texts, routed through a Moroccan country code to obscure the operators' locations, contain tell-tale flaws. These include misspelt sign-offs such as "RingGo Customer Servicess" and web addresses that start with "ringgo" but deviate into random characters. Some messages have already been flagged by Apple with a "report spam" button.
A RingGo spokesperson urged customers to ignore the texts completely, delete them, and check for genuine charges via the official application. Anyone who has submitted financial details to the counterfeit site must contact their bank immediately and update their passwords. Suspected fraud can be reported to the National Cyber Security Centre by forwarding the message to 7726.
