Toll text scam: how fake unpaid-toll texts work and what to do

A text saying you owe an unpaid toll and must pay through a link is almost always a scam. Toll agencies such as E-ZPass, SunPass, FasTrak and TxTag say they do not ask for payment by text with a link, so the safe move is simple: don’t tap the link, don’t reply, and check your balance by typing your toll agency’s real website yourself or calling the number on your statement.

If you already entered card details on a page from one of these texts, call your card issuer now, using the number on the back of your card. The rest of this guide explains how the toll text scam works, how to tell a real toll notice from a fake one, and what to do at each stage, including after you have paid.

What a toll text scam looks like

The messages are short, urgent and nearly identical across states. The FBI’s Internet Crime Complaint Center (IC3) published one example in its April 2024 warning: a text claiming “an outstanding toll amount of $12.51” with a threat of a $50.00 late fee, followed by a link (IC3 PSA). The FTC’s alert from May 2024 quotes a near-copy: an “outstanding balance of $11.69” and a $50.00 late fee (FTC).

Other versions threaten “penalties or legal action” by a set date, or claim to come from a state transportation department. The Michigan Attorney General collected examples signed “E-ZPass final reminder” and “Michigan Department of Transportation Final Reminder” (Michigan AG).

The brand changes with where the scammer thinks you live. The FTC says the texts look like they come from toll programs “all over the country, from SunPass in Florida to FasTrak in San Francisco” (FTC Data Spotlight). You can receive one for a state you have never driven in: Massachusetts transportation officials told KrebsOnSecurity that the target numbers appear to be chosen at random, not linked to an account or to toll road use (KrebsOnSecurity).

A newer variant swaps the toll for a traffic ticket or a DMV fine. The FTC warned about fake “overdue traffic ticket” texts in July 2025, with threats of license suspension and extra fees (FTC), and state agencies issued new warnings in 2026. PennDOT says it “does not send text messages to customers for any reason” (PA Turnpike and PennDOT), and the Iowa DOT notes it does not collect tolls on any of its roads or bridges (Iowa DOT).

How the toll text scam works, step by step

The few dollars in the text are bait. According to the FTC, what these scammers are really after is “credit card and even Social Security numbers” (FTC Data Spotlight).

Steps 3 to 5 come from security researcher Ford Merrill, interviewed by KrebsOnSecurity. He explains that anything typed into the phishing page’s fields is captured in real time, whether or not you press submit. The fake site then asks for a one-time code, which is really the code your bank sends to confirm that you want to link your card to a mobile wallet. If you hand it over, the criminals add your card to a wallet on a phone they control (KrebsOnSecurity).

That is why the reported losses on the toll itself look tiny. The FBI’s 2024 annual report counted 59,271 toll scam complaints but only $129,624 in reported losses (IC3 2024 report). The fake toll is a few dollars; the stolen card is worth far more, and later charges may never be traced back to the text.

Who sends toll scam texts

Researchers attribute much of the wave to a Chinese-speaking phishing network known as the Smishing Triad, which sells ready-made phishing kits to other criminals.

• Scale. Palo Alto Networks’ Unit 42 identified over 194,000 malicious domains linked to the operation since January 1, 2024, and found toll services to be the most impersonated category, with nearly 90,000 phishing domains (Unit 42).
• Speed. About 29% of those domains were live for two days or less, and 71% for less than a week (Unit 42). Blocklists struggle to keep up, which is why a link can look fine to your phone.
• Channels. Resecurity reported that the group uses iMessage to reach iPhone users and RCS to reach Android users (Resecurity). Unit 42 saw senders shift toward U.S. (+1) phone numbers (Unit 42).
• Reach. Silent Push counted over 90,000 domains across the network’s lifetime and targets in at least 121 countries (Silent Push).

In November 2025, Google sued the operators of a phishing kit it calls “Lighthouse,” saying it had harmed over 1 million victims in more than 120 countries and that the attacks exploit brands such as E-Z Pass (Google). The lawsuit disrupted part of the operation, but toll and DMV texts kept arriving through 2026: the FTC reported in May 2026 that government imposter reports were “up 40%, thanks in part to messages about overdue tolls” (FTC). In June 2026 Google filed a second suit, against a network it calls Outsider Enterprise, and quoted the FBI saying criminals increasingly use AI to make fraud like this more convincing (Google). That case centers on other lures, but Group-IB describes the network as part of the same Smishing Triad ecosystem (Group-IB).

Do toll agencies ever send texts?

Some do, but only from specific numbers and never with a pay-by-link demand for an unknown balance. Here is what the agencies themselves say:

California’s Attorney General lists the official toll sites for that state and notes that toll agencies do not text people who have no account with them (California AG). Policies can change, so if a text names a specific agency, compare it with the contact details on that agency’s own site, reached by typing the address yourself.

Red flags in a toll text

Any one of these is enough to stop:

• A link to pay. The agencies above say they don’t collect unpaid tolls through a texted link.
• An odd sender. A long or international number instead of the agency’s short code. The FCC notes the sender may be an international number, and other people may be included as recipients (FCC).
• A strange web address. A real brand name buried in a longer domain, such as the pattern e-zpassny.gov-xxxx.live that Unit 42 describes (Unit 42). Real agency sites end in their own domain, not in .live, .xin or .top.
• Urgency and threats. A late fee, legal action, or a suspended license or registration by a close deadline (Michigan AG).
• A generic greeting. “Dear customer” or “E-ZPass user” instead of your name (FCC).
• A request to reply “Y.” See the next section.
• A request for a one-time code. No toll payment needs the code your bank sends to add your card to a wallet.

Why the text asks you to reply “Y”

On an iPhone, links in messages from unknown senders are often not clickable. Scammers work around this by asking you to reply, then reopen the message. New York State’s consumer warning describes texts that ask the recipient to reply “Y” to receive a link (New York State), and Apple told BleepingComputer that replying to the message or adding the sender to your contacts enables the links (BleepingComputer). Replying also tells the sender your number is live.

Apple notes another reason not to reply: message filtering does not apply to a sender you have replied to three times or more (Apple Support). The Florida’s Turnpike advice is to not respond at all, even when the text says to “text STOP” (Florida’s Turnpike).

How to check if you really owe a toll

1. Close the message. Don’t use any link or phone number in it. The FTC’s advice is to contact the tolling agency “using a phone number or website you know is real — not the info from the text” (FTC).
2. Go to the source yourself. Type your agency’s address, open its official app, or call the number on your statement or transponder paperwork.
3. Look at the account. E-ZPass Virginia’s advice is to log in to verify your balance and transactions (E-ZPass Virginia). Toll bills often come by post: the PA Turnpike, for example, sends overdue notices by U.S. Mail (PA Turnpike).
4. Report and delete (see below).

What to do if you clicked or paid

Move fast, in this order. For a broader checklist, see our guide to what to do in the first hour after money is stolen.

If you only opened the link. Close the page without typing anything, report the text and delete it. Remember that anything typed into the form may have been captured even if you never pressed Pay (KrebsOnSecurity).

If you entered card details or paid.

1. Call your card issuer now, using the number on the back of your card. The FTC’s advice is to report the payment right away and ask for your money back (FTC). Ask the issuer to cancel and reissue the card.
2. Ask about mobile wallets. Tell the issuer you may have shared a one-time code, and ask it to check for, and remove, any Apple Pay or Google Pay wallet your card was recently added to.
3. Watch your statements for small test charges as well as large ones, and dispute anything you don’t recognize.

If you shared your Social Security number, go to IdentityTheft.gov for a recovery plan. The Iowa DOT also suggests pulling your free credit reports at annualcreditreport.com (Iowa DOT).

If you entered a password, change it wherever you use it and turn on two-factor authentication (FTC). Our 12-point checklist covers passkeys and account alerts.

How to report a toll scam text

• To your carrier: copy the message and forward it to 7726 (SPAM) (FTC; FCC).
• In your messaging app: on an iPhone, tap Report Junk under the message (Apple Support); Android messaging apps have a similar report-spam option.
• To the FTC: at ReportFraud.ftc.gov.
• To the FBI: at ic3.gov. The FBI asks toll scam victims to include the phone number the text came from and the website in the message (IC3 PSA). IC3 says it will never contact you directly for information or money (IC3), so treat any “IC3 agent” who calls you as another scam.

Then delete the text.

How we checked this

We built this guide from warnings published by the FTC, the FBI’s IC3, the FCC, state attorneys general and the toll agencies themselves, plus original research by Palo Alto Networks Unit 42, Resecurity and Silent Push. Where an agency’s texting policy is quoted, it is taken from that agency’s own page. Facts checked on September 27, 2026. For more on text and phone scams, see our wrong number text scam guide, the AI scams catalog and all scam protection guides.