South African Road Agency Warns of Sophisticated Smishing Scams

Mass smishing campaigns targeting South African motorists use roughly 200 cloned domains mimicking traffic authorities and petrol brands. According to MyBroadband reporting, the Road Traffic Infringement Agency warned of sophisticated payment scams featuring fake licence suspension threats.

South African motorists face a wave of deceptive smishing operations exploiting traffic systems and fuel station brands, according to an industry source who spoke to MyBroadband. Investigators identified roughly 200 domains imitating official traffic entities and forecourt brands. A reviewed spreadsheet detailing 190 of these web addresses reveals threat actors impersonating FinesSA and the Administrative Adjudication of Road Traffic Offences Act system.

Cloned Domains and Irontroll Infrastructure

The threat actor driving these attacks is suspected to be the Smishing Triad, operating via a platform known as Irontroll, an industry source told MyBroadband. The fraudulent web infrastructure targets motorists with lookalike domains. Variations mimicking the AARTO framework include aartd-finse.autos, aarta-finse.autos, and aarto-finea.cfd. FinesSA copycats include fineas.cfd, finesa.meichs.cfd, and finesea.cc. The malicious network also features numerous domains imitating forecourt brands like Engen, alongside others targeting non-motoring organizations.

RTIA Warnings on Phishing and Cloned Portals

The Road Traffic Infringement Agency issued a public warning regarding an increase in sophisticated scams utilizing cloned payment portals, SMS messages, WhatsApp, and emails. The agency stressed that it holds exclusive legal authority to administer and process fines under the AARTO Act, advising motorists to use only verified payment platforms.

The RTIA emphasises that it is the only entity which is legally authorised to administer and process fines under the AARTO Act. Motorists are strongly advised to make payments only through verified and approved payment platforms.
Road Traffic Infringement Agency

Scammers frequently deploy communications featuring subject lines such as Final Notice: Action Required to Avoid Additional Penalties or Final Demand: Enforcement Notices. These messages often arrive after working hours or on weekends to manufacture panic, timing attacks for periods when targets hold accessible funds.

Tactics and Official Guidance for Motorists

Fraudsters commonly threaten victims with licence suspensions, vehicle licence disc blocks, and additional financial penalties. One observed scam message instructed recipients to pay R250 on the day of receipt to secure a discount. To counter these operations, the RTIA outlined specific red flags and safe practices for road users.

Motorists are advised to inspect communications for typographical errors, including misspellings of NATIS. Legitimate AARTO infringement notices arrive exclusively in password-protected PDFs that require the account holder’s ID number, Business BRN/TRN, or passport number to unlock.

Road Users must not press any link and delete the email immediately.
Road Traffic Infringement Agency

The official AARTO payment portal is located at https://online.aarto.gov.za. The agency advises that any alternative links employing .com, .co.za, or .online domains are fraudulent, and motorists should verify suspicious communications directly with the RTIA before sharing identification or banking details.