The Unpaid Toll Text Scam: Why That “You Owe a Toll” Text Is Fake

You’ve probably gotten one already this week: “Your vehicle has an unpaid toll of $12.51. To avoid a late fee, pay at [link].” Maybe it named a state you’ve never driven through. Maybe you don’t even own a transponder. It still buys a half-second of doubt — did I miss a toll? — and that half-second is the entire business model.

The “unpaid toll” text went from nowhere to everywhere almost overnight. The FBI’s Internet Crime Complaint Center first warned about it in April 2024, after more than 2,000 complaints arrived in about five weeks from just three states. Within a year it was nationwide, and by the FTC’s count, bogus unpaid tolls were the fourth most-reported text scam of 2024.

Is the unpaid toll text a scam?

Almost always, yes. U.S. tolling agencies — E-ZPass and its state versions, SunPass in Florida, FasTrak in California, TxTag in Texas, Peach Pass in Georgia — do not send unsolicited texts demanding payment through a link. Consumer Reports contacted the agencies directly and concluded that essentially every text claiming to be from a toll agency and asking for payment is fake. If you’re genuinely unsure whether you owe a toll, there is one safe way to check — and it is never the link in the text.

How the toll text scam works

It runs on volume, not accuracy. Once you can see the five steps, the next one that lands is obvious.

1. The blast. The same message goes to millions of random numbers — “spray and pray.” That’s why you get toll texts for states you’ve never visited, or with no transponder at all. The message has nothing to do with your actual driving.
2. The small, believable number. The “toll” is almost always tiny — often $12.51, usually under $25 — because a small amount is easier to pay than to question. It’s wrapped in a threat: a late fee “in the hundreds,” or your license or vehicle registration suspended.
3. The look-alike page. The link opens a convincing copy of the toll agency’s site on a look-alike domain. You enter your name, address, and card number, expiration, and CVV — sometimes your Social Security number.
4. The real payday. As one researcher put it, they don’t care about the seven dollars — they want the card. The stolen number is loaded into a mobile wallet (Apple Pay or Google Wallet), and the fake page phishes the one-time passcode your bank sends you, in real time, to finish the enrollment.
5. The cash-out. Operators load several stolen cards onto phones, wait a week or two, then spend or resell them. Your “$12.51 toll” becomes a working card in a stranger’s wallet halfway around the world.

This isn’t one scammer with a burner phone. Most of these campaigns trace to a China-based operation researchers call the “Smishing Triad,” which rents a ready-made phishing kit to hundreds of operators — the same machine behind the fake USPS texts. Google sued 25 of its alleged operators in November 2025. It’s the identical bait we take apart in our USPS package-text scam guide; only the logo on the front changes.

Why are toll scam texts still getting through in 2026?

Because the operation behind them grew faster than the filters did. Here’s what changed in the 2025–2026 wave, and why the texts keep landing even after lawsuits and takedowns:

• Nearly 200,000 throwaway web addresses. In October 2025, Palo Alto Networks’ Unit 42 traced 194,345 domain names registered since January 2024 to the Smishing Triad operation. Toll services were the most impersonated category, with nearly 90,000 of them. Most are disposable: about 83% were gone within two weeks, which is why a blocklist is always a step behind.
• Texts that never touch your carrier’s network. Many of these lures arrive as iMessages on iPhones and RCS messages on Android phones rather than ordinary SMS. As Brian Krebs reported in April 2025, that lets them bypass the mobile phone networks entirely, so carrier-level text filtering never gets a look, and they land at a near-100% rate until Apple or Google suspends the sending account.
• The “reply Y” trick. iMessage disables links in texts from unknown senders. Apple told BleepingComputer that replying to the message, or adding the sender to your contacts, turns the links back on. So since early 2025 the texts have asked people to reply “Y,” close the message, and reopen it. Don’t. Even a one-letter reply tells the senders they’ve found a live number, which means more attempts.
• A takedown that didn’t end it. Days after Google sued the alleged operators of the “Lighthouse” phishing kit in November 2025, it told SecurityWeek that Lighthouse’s operations had been shut down; the operators’ own message suggested they hoped to be back. The texts kept coming. In April 2026, Consumer Reports was still warning drivers that texts about tolls are almost always scams.
• Texts are now the top way scammers reach people. In March 2026 testimony to Congress, the FTC said a text message was the top reported contact method in 2025 among fraud reports that named one.

None of that changes your move. It just explains why “my phone would have filtered it” isn’t a defense, and why the tells below still matter.

The tells: how to spot it in five seconds

Any one of these is enough to delete the message:

• The web address is wrong. Real agencies use short, official .com or .gov addresses. Scam links use look-alikes and odd endings — .xin, .top, .vip, .xyz — or padding like ezpass-tolls-notice.com-pay.
• You don’t have an account there. A “SunPass” text when you’ve never driven in Florida is fake by definition.
• A tiny amount, a giant threat. A few dollars owed, but “pay now or lose your registration.” Real toll notices give you time and arrive mostly by mail.
• The sender is off. A regular 10-digit cell number, an email address, or an international code like +63 — not a short code you signed up with. Some versions even ask you to reply “Y” first, a trick to get around link-blocking.
• It asks for a card, CVV, SSN, or a bank code. No legitimate toll payment works by pasting your card into a texted link.

Not sure about a specific message? Paste it into our free SMS Scam Checker — it flags the tells and the tactic behind them in seconds, and nothing you paste ever leaves your browser.

Do E-ZPass, SunPass, or FasTrak ever text you?

Some do send opt-in account alerts — a low-balance warning, an auto-replenish receipt — but those never carry a payment link and never ask for your card. Genuinely overdue tolls are handled mostly by mail, referencing your specific plate and account; a handful of agencies use licensed collection firms that may text about a real, delinquent account, with real account details. The safe rule cuts through all of it: a text asking you to pay a toll by tapping a link is fake. Check any real balance by opening your toll agency’s app, or typing its official address into your browser yourself — never the link you were sent.

Here’s what some of the agencies themselves say. SunPass told Florida reporters it will not ask customers to make a payment via text or to act urgently, and that when it does text, the message comes from the short code 786727 (its emails come from customerservice@sunpass.com or noreply@sunpass.com). Washington’s Good To Go! says it does not send bills through text messages, and all of its texts come from 75381. Texas is blunter still: TxTag/TxDOT does not send texts or emails for past due tolls. And the E-ZPass Group, the association behind the E-ZPass network, points out that it does not hold customer accounts or collect tolls at all, so a message “from E-ZPass Group” saying you owe money is a scam by definition.

One wrinkle worth knowing: real toll texts are becoming slightly less rare. In April 2026 the Pennsylvania Turnpike said it would pilot text reminders for some Toll By Plate customers who hadn’t paid their first invoice, and said those legitimate texts would not request direct payment. Which is why the rule is “never pay from the text,” not “every toll text is fake.” Even a real reminder is something you check by typing the agency’s address yourself.

Figure 01 · Scam text vs. real toll bill ScamDrill

Sources: FBI IC3 PSA, 12 April 2024; BleepingComputer, 12 January 2025; Krebs on Security, 10 April 2025; Consumer Reports, 27 April 2026; Pennsylvania Turnpike Toll By Plate. Amber marks the scammer’s move, red the point of loss, blue the real thing.

How to check if you really owe a toll

Ignore the text entirely and go to the source. Three ways, from quickest to slowest:

1. Your toll agency’s app or website, opened from your home screen or typed into the browser yourself. Log in to see your balance and any unpaid trips.
2. The customer service number on the agency’s site or on a statement you already have. If you have an E-ZPass, the E-ZPass Group notes that your transponder itself names the agency that issued it, with that agency’s phone number.
3. Your mailbox. If you drove through without a transponder, the real bill comes by mail. On the Pennsylvania Turnpike, for example, cameras photograph your plate and an invoice is mailed to the vehicle’s registered owner about 40 days after travel, which you can pay online, by phone, or by mail.

These are the official addresses for the major U.S. toll systems, checked in October 2026. We’ve left them unlinked on purpose: the habit worth building is typing them in yourself.

Two notes on the list. In Texas, the Harris County Toll Road Authority has handled TxTag accounts since November 2024, so the old txtag.org address now forwards to a TxDOT page that sends you to hctra.org. And in California, FasTrak is run by several agencies; your statement names yours. If your system isn’t here, find your state transportation department’s official site and follow its toll links from there, rather than searching for “pay toll” and clicking the first ad.

What to do if you already clicked, paid, or entered your card

Find the line that matches what you did and work down from there. Speed matters most if a card number or a code left your phone.

1. Only tapped the link, typed nothing? You’re very likely fine. Close the page, don’t go back, don’t reply, and report the text before you delete it (the reporting steps are below).
2. Entered a card number, or paid the “toll”? Call the card issuer now, on the number on the back of the card, not one from the text or the payment page. Say the card was entered on a phishing site, ask them to cancel and reissue it, and dispute every charge you don’t recognize, including small “test” charges.
3. Getting codes or wallet prompts? If your bank texts you a verification code you didn’t ask for, or your phone asks you to approve adding your card to Apple Pay or Google Wallet, don’t approve it. That’s the crooks trying to load your card onto their phone. If you already typed a code into the fake page, tell your issuer that specifically: that code is what adds your card to a wallet on a device the phishers control.
4. Gave your Social Security or driver’s license number? The FTC warns these pages can collect your driver’s license number along with your card. Freeze your credit at Equifax, Experian, and TransUnion, and build a recovery plan at IdentityTheft.gov.
5. Typed a password on the fake page? Change it everywhere you’ve used it, starting with your email and your real toll account, and turn on two-step verification where it’s offered.
6. Expect a follow-up offer to “fix” it. Anyone who contacts you afterward offering to reverse the charge or recover your money for a fee is running a second scam. The FTC’s rule is short: never pay upfront for a refund or help with a refund. Our guides to recovery scams and the fake “fraud department” callback show what that second contact sounds like.
7. Report it. Forward the text to 7726, then file at reportfraud.ftc.gov and ic3.gov with the sender’s number and the link. The steps are just below.

If more than a card is involved, our first-60-minutes checklist walks the whole sequence in order, and our what-to-do-now tool builds a plan for your exact situation.

How to report a toll scam text

Reporting takes about a minute and genuinely helps shut the senders down:

1. Forward the text to 7726 (SPAM). That’s the carrier shortcode that helps your provider block similar messages — and use “Report Junk” in your Messages app too.
2. Report it to the FTC at reportfraud.ftc.gov and to the FBI at ic3.gov — include the sender’s number and the link.
3. Tell the real agency. Report it through your actual toll agency’s official site so they can post a warning — and you can report it to us to help warn the next person.
4. Delete it. Then move on. There’s no unpaid toll to worry about.