The Unpaid Toll Text Scam: Why That “You Owe a Toll” Text Is Fake

You’ve probably gotten one already this week: “Your vehicle has an unpaid toll of $12.51. To avoid a late fee, pay at [link].” Maybe it named a state you’ve never driven through. Maybe you don’t even own a transponder. It still buys a half-second of doubt — did I miss a toll? — and that half-second is the entire business model.

The “unpaid toll” text went from nowhere to everywhere almost overnight. The FBI’s Internet Crime Complaint Center first warned about it in April 2024, after more than 2,000 complaints arrived in about five weeks from just three states. Within a year it was nationwide, and by the FTC’s count, bogus unpaid tolls were the fourth most-reported text scam of 2024.

Is the unpaid toll text a scam?

Almost always, yes. U.S. tolling agencies — E-ZPass and its state versions, SunPass in Florida, FasTrak in California, TxTag in Texas, Peach Pass in Georgia — do not send unsolicited texts demanding payment through a link. Consumer Reports contacted the agencies directly and concluded that essentially every text claiming to be from a toll agency and asking for payment is fake. If you’re genuinely unsure whether you owe a toll, there is one safe way to check — and it is never the link in the text.

How the toll text scam works

It runs on volume, not accuracy. Once you can see the five steps, the next one that lands is obvious.

1. The blast. The same message goes to millions of random numbers — “spray and pray.” That’s why you get toll texts for states you’ve never visited, or with no transponder at all. The message has nothing to do with your actual driving.
2. The small, believable number. The “toll” is almost always tiny — often $12.51, usually under $25 — because a small amount is easier to pay than to question. It’s wrapped in a threat: a late fee “in the hundreds,” or your license or vehicle registration suspended.
3. The look-alike page. The link opens a convincing copy of the toll agency’s site on a look-alike domain. You enter your name, address, and card number, expiration, and CVV — sometimes your Social Security number.
4. The real payday. As one researcher put it, they don’t care about the seven dollars — they want the card. The stolen number is loaded into a mobile wallet (Apple Pay or Google Wallet), and the fake page phishes the one-time passcode your bank sends you, in real time, to finish the enrollment.
5. The cash-out. Operators load several stolen cards onto phones, wait a week or two, then spend or resell them. Your “$12.51 toll” becomes a working card in a stranger’s wallet halfway around the world.

This isn’t one scammer with a burner phone. Most of these campaigns trace to a China-based operation researchers call the “Smishing Triad,” which rents a ready-made phishing kit to hundreds of operators — the same machine behind the fake USPS texts. Google sued 25 of its alleged operators in November 2025. It’s the identical bait we take apart in our USPS package-text scam guide; only the logo on the front changes.

The tells: how to spot it in five seconds

Any one of these is enough to delete the message:

• The web address is wrong. Real agencies use short, official .com or .gov addresses. Scam links use look-alikes and odd endings — .xin, .top, .vip, .xyz — or padding like ezpass-tolls-notice.com-pay.
• You don’t have an account there. A “SunPass” text when you’ve never driven in Florida is fake by definition.
• A tiny amount, a giant threat. A few dollars owed, but “pay now or lose your registration.” Real toll notices give you time and arrive mostly by mail.
• The sender is off. A regular 10-digit cell number, an email address, or an international code like +63 — not a short code you signed up with. Some versions even ask you to reply “Y” first, a trick to get around link-blocking.
• It asks for a card, CVV, SSN, or a bank code. No legitimate toll payment works by pasting your card into a texted link.

Not sure about a specific message? Paste it into our free SMS Scam Checker — it flags the tells and the tactic behind them in seconds, and nothing you paste ever leaves your browser.

Do E-ZPass, SunPass, or FasTrak ever text you?

Some do send opt-in account alerts — a low-balance warning, an auto-replenish receipt — but those never carry a payment link and never ask for your card. Genuinely overdue tolls are handled mostly by mail, referencing your specific plate and account; a handful of agencies use licensed collection firms that may text about a real, delinquent account, with real account details. The safe rule cuts through all of it: a text asking you to pay a toll by tapping a link is fake. Check any real balance by opening your toll agency’s app, or typing its official address into your browser yourself — never the link you were sent.

What to do if you already tapped or paid

If you only tapped the link but entered nothing, you’re very likely fine — close the page, don’t go back, and delete the text. If you also handed over your Social Security number, freeze your credit at all three bureaus (Equifax, Experian, and TransUnion) and start a recovery plan at IdentityTheft.gov. Not sure what applies to you? Our what-to-do-now tool walks you through the exact steps, and our guide to the first 60 minutes after a scam covers the fast-moving cases.

How to report a toll scam text

Reporting takes about a minute and genuinely helps shut the senders down:

1. Forward the text to 7726 (SPAM). That’s the carrier shortcode that helps your provider block similar messages — and use “Report Junk” in your Messages app too.
2. Report it to the FTC at reportfraud.ftc.gov and to the FBI at ic3.gov — include the sender’s number and the link.
3. Tell the real agency. Report it through your actual toll agency’s official site so they can post a warning — and you can report it to us to help warn the next person.
4. Delete it. Then move on. There’s no unpaid toll to worry about.