Dart Crossing Payment - Suspicious email

[Davidm]

THE URLS BELOW ARE SUSPICIOUS - DON'T CLICK

I've received what I think is a suspicious email about payments for
the Dart Crossing. The email appears to come from:
donot...@dartford-crossing-charge.service.gov.uk
but the various links in the text are strange eg:
https://gov.uk/dart-charge
actually points to
https://r.dartford-crossing-charge.service.gov.uk/tr/cl/-
DAXzJbN5pXNmb1xtxbB1Q0tDoGhmswWmjMqFlMn-
8JzJ2DE5evaZ9e0dM3ppvkR6zJS9zt5oxmvWwoDqkr-
MAOa5bMS0bjVghtTALCF5-sqErt3ImK2teU4qycFmI-
FzxhVU6b89-_YgzekM_bahawPmAqO4QCHmD1H4-
J0-hXpETxc-tHVEIhsZ55NLnUagL6yNk_L3iEUKhmt-
sFlRz2Oboe34mpCNbaxUgsa1oHZTp35fGBiySTQb-
WdtVEI4O6Hg

(the - at then end of each line have been added by me
so as to display the whole thing)

It's the r.dartford bit that made me look in more detail.
However the email has been sent to the address I used whan I set up my
account a few years ago, and it quotes my correct account number.

Anyone else seen this, is it a scam? I've not responded to the email,
but could post a copy here, or in a cloud somewhere.

[Mark Goodge]

On Mon, 31 Jul 2023 12:02:57 +0100, Davidm <davidm_...@hotmail.com>
wrote:

>THE URLS BELOW ARE SUSPICIOUS - DON'T CLICK
>
>I've received what I think is a suspicious email about payments for
>the Dart Crossing. The email appears to come from:
>donot...@dartford-crossing-charge.service.gov.uk
>but the various links in the text are strange eg:
>https://gov.uk/dart-charge
>actually points to
>https://r.dartford-crossing-charge.service.gov.uk/tr/cl/-
>DAXzJbN5pXNmb1xtxbB1Q0tDoGhmswWmjMqFlMn-
>8JzJ2DE5evaZ9e0dM3ppvkR6zJS9zt5oxmvWwoDqkr-
>MAOa5bMS0bjVghtTALCF5-sqErt3ImK2teU4qycFmI-
>FzxhVU6b89-_YgzekM_bahawPmAqO4QCHmD1H4-
>J0-hXpETxc-tHVEIhsZ55NLnUagL6yNk_L3iEUKhmt-
>sFlRz2Oboe34mpCNbaxUgsa1oHZTp35fGBiySTQb-
>WdtVEI4O6Hg

Those are official government URLs. The hostname is the key here, and both
of them are subdomains of gov.uk:

dartford-crossing-charge.service.gov.uk
r.dartford-crossing-charge.service.gov.uk

And service.gov.uk is a genuine gov.uk domain:

# whois service.gov.uk

Domain:
service.gov.uk

Registered For:
Government Digital Service

[rest snipped]

The stuff after the hostname is just a tracking identifier added by the
Email Service Provider that the government has contracted to handle the Dart
Charge emails.

>(the - at then end of each line have been added by me
>so as to display the whole thing)
>
>It's the r.dartford bit that made me look in more detail.

The r.dartford bit at the beginning is just a hostname of the ESP's mail
tracking server. Following it futher through, it appears to be operated by
Brevo (formerly Sendinblue), a well-known ESP based in France.

https://www.brevo.com/

>However the email has been sent to the address I used whan I set up my
>account a few years ago, and it quotes my correct account number.
>
>Anyone else seen this, is it a scam? I've not responded to the email,
>but could post a copy here, or in a cloud somewhere.

It's not a scam, no.

(Some might argue that the Dart Charge is a scam, but that's an entirely
different debate. Some might also argue that the UK government should be
using a UK-based ESP. But that's also a different debate).

Mark

[Jon Ribbens]

On 2023-07-31, Davidm <davidm_...@hotmail.com> wrote:
> THE URLS BELOW ARE SUSPICIOUS - DON'T CLICK
>
> I've received what I think is a suspicious email about payments for
> the Dart Crossing. The email appears to come from:
> donot...@dartford-crossing-charge.service.gov.uk
> but the various links in the text are strange eg:
> https://gov.uk/dart-charge
> actually points to
> https://r.dartford-crossing-charge.service.gov.uk/tr/cl/-

... etc ...

> It's the r.dartford bit that made me look in more detail.
> However the email has been sent to the address I used whan I set up my
> account a few years ago, and it quotes my correct account number.
>
> Anyone else seen this, is it a scam? I've not responded to the email,
> but could post a copy here, or in a cloud somewhere.

Neither of the links above are a scam link, or suspicious. They are both
official gov.uk domains, although the actual service appears to be being
provided by a company called "Brevo".

[JNugent]

I too got one, a couple of weeks ago. I'm sure it's legitimate.

The email doesn't ask the recipient to reply to it.

Just go to the Dart Charge website in the normal way and update your
payment method, as you always occasionally had to.

[Roger Hayter]

On 31 Jul 2023 at 14:38:56 BST, "Jon Ribbens" <jon+u...@unequivocal.eu>
wrote:

It is rather unsatisfactory that people should not only have to examine the
actual URL rather than the wording of the link, *and* be able to carefully
interpret not only the domain it starts with but ensure that there is no code
in masses of numbers after it that might take them somewhere different.

--
Roger Hayter

[David McNeish]

If the first part of the URL is *.gov.uk/, do you need to look at the rest of it?
Surely the first place it takes you must be a .gov.uk site?

[Jon Ribbens]

Indeed. It can be a bit tricky to completely reliably identify which
part of the URL to look at however, but modern browsers tend to hide
or de-emphasis the non-relevant parts in order to make it easier.

[Mark Goodge]

On Mon, 31 Jul 2023 09:13:18 -0700 (PDT), David McNeish <davi...@gmail.com>
wrote:

Yes, it does. Or, to be more precise, it must take you to a website that has
a public hostname in *.gov.uk. It may not, of course, actually be operated
by a government entity itself, as it could be contracted out (as, indeed
this one is). But it must be an official address.

The stuff after the hostname is tracking data, which can be linked by the
ESP to the email address that the message was sent to. It then redirects
back to the actual payment page - which is exactly where you end up if you
go straight to the shorter URL in the text of the email.

Mark

[notya...@gmail.com]

Dartford Crossing has changed its IT
https://www.newsshopper.co.uk/news/23651236.dartford-crossing-dart-charge-payments-change-today/
and porked it.

If you haven't used it then the message is probably spurious you just need to register for the new system (once it will let you), if you have, well bad luck...
https://www.fleetnews.co.uk/news/car-industry-news/2023/07/31/problems-with-new-payment-system-for-dart-charge
"Dart Charge: Drivers struggling to pay for Dartford Crossing"
https://www.bbc.co.uk/news/uk-england-66361486

Just think about how much fun it is going to be in Dover on 1/11/23...

[Scion]

On Mon, 31 Jul 2023 16:58:57 +0000, Jon Ribbens wrote:

<snip>

> Indeed. It can be a bit tricky to completely reliably identify which
> part of the URL to look at however, but modern browsers tend to hide or
> de-emphasis the non-relevant parts in order to make it easier.

Yes - once you've clicked on the link.

[Jon Ribbens]

True, but if you do nothing with the browser window except close it
then there should be no harm done, even if the link is malicious.

[Davidm]

On Mon, 31 Jul 2023 12:02:57 +0100, Davidm
<davidm_...@hotmail.com> wrote:

Thanks all for your replies.

There was something on BBC news yesterday about the problems people
were having with the new system and being able to pay, or not.
Something of a pigs breakfast by the sound of it, (with apologies to
the pig!).

Glad I have no plans to use the crossing in the near future.

[Martin Harran]

On Mon, 31 Jul 2023 12:02:57 +0100, Davidm
<davidm_...@hotmail.com> wrote:

>From what people have said here, those appear to be genuine, but this
is an area where you have to be careful. Here in Ireland, where we
have motorway tolls, we are plagued with bogus messages, particularly
texts, about unpaid toll charges.

[Roger Hayter]

Do you? Last time I was there you didn't seem to have motorways.


--
Roger Hayter

[Alistair Tyrrell]

In article <kips98...@mid.individual.net>,
jnu...@mail.com says...

It's moved to a new provider or something. The new one
doesn't work, they seem to be throttling it due to
overload. Try again another day.

[Martin Harran]

That must have been quite a while ago, tyhe first one opened in 1983!

https://en.wikipedia.org/wiki/Motorways_in_the_Republic_of_Ireland#History

A number of motorway stretches were constructed via public/private
partnership, hence the tolls on them.

[Scion]

That's the hope these days, although there have been plenty of malware
vectors that only needed you to visit a compromised or malicious website.

[JNugent]

There have been motorways in Ireland for many years now. Some parts of
the network are tolled.

[JNugent]

I was there in 1981, staying at Bray.

The N11 (well, part of it) was clearly destined to be a motorway.

[Martin Harran]

The Irish Government were quite clever with this. As they upgraded the
worst parts of main nroads that would eventually be motorway, they
upgraded that stretch to moterway standard. I remember in late
80s/early 90's travelling Belfast to Dublin, you would have 4 or 5
miles of motorway followed by a stretch of standard road followed by
another 4 or 5 miles of motorway followed by a stretch of standard
road, etc. Eventually, it all linked up :)

[Brian]

I suspect, partly having read your later post, you received this as you’ve
not used the account / crossing for some time.

They have a ‘clean up’ of old / dormant accounts every now and then. I’m
not sure of the trigger time. I have an account and the timing of our use
and lockdown triggered a ‘do you want to keep your account’ Email so it
isn’t that long- I suspect 18 mths to 24 mth.

I’ve an account on another crossing - the Tyne Tunnel. I keep expecting
them to invite me to close the account and let them keep the balance.