By Christine DiGangi

As if driving on toll roads wasn’t already an annoying experience, drivers now have to watch out for a scam targeting E-ZPass users. The Metropolitan Transit Authority of New York (MTA) issued a warning to toll-road travelers to watch out for an E-ZPass phishing scam that popped up recently: It’s an email to consumers saying they haven’t paid a toll and need to rectify the debt as soon as possible.

How to Spot a Scam

Phishing is an identity theft strategy in which scammers impersonate a seeming legitimate company or person in an attempt to have you divulge your personal information or account credentials that can then be used by thieves to hijack your accounts. Email is essentially the master key to your life – bank accounts, social media and personal interactions – which is why it’s such a coveted target for identity thieves.

The fake E-ZPass email looks like it comes from the company (the bottom even shows a link to its phishing policy, next to its privacy policy and terms and conditions), and it asks the recipient to download the invoice for his or her unpaid toll. It’s pretty convincing, and if you’re the kind of person who gets flustered by a notice of outstanding debt, it’s easy to feel like you should download the bill and take care of it ASAP.

The real E-ZPass doesn’t send emails to people if they miss tolls. The same is true for a lot of companies following up on debts (like the Internal Revenue Service, for example), so if you receive an email asking you to pay up, you should call customer service before clicking anything.

What to Do If You’ve Been Hacked

If you fall victim to one of these charades, take immediate action to shield your identity. Start by resetting your email password, enable multi-factor verification if you haven’t yet done so, then update login credentials to other sites, like your bank accounts and social media accounts. A strong password is important, but it won’t do much if someone gets access to it or if you use it across multiple accounts. Here are some tips on creating strong passwords.

Preventing identity theft is very difficult, which is why you need to fine-tune your damage-control plan. Monitor your accounts for unauthorized activity by checking your transactions regularly (daily, if possible), and check your credit scores for sudden changes, which can be indicative of fraud. You can get your free credit data through Credit.com, and you should also review your credit reports, which you can get for free once a year.