Toll road text scam: the amounts, the operators, the next steps

What the text says and what it threatens

The FBI’s Internet Crime Complaint Center, IC3, published its alert on 12 April 2024. It said that since early March 2024 it had received over 2,000 complaints about smishing texts representing a road toll collection service, from at least three states, and that the scam might be moving from state to state. Its sample text carries a $12.51 balance and a $50.00 late fee. IC3 says the “outstanding toll amount” is similar among the complaints. Our page on text message scams covers the FBI’s sample text beside the FTC’s list of the texts it saw most, so we only point to it here.

AARP’s page, updated on 29 April 2026, says that according to the FBI the scam began gathering steam in the spring of 2024 and then “exploded”. It describes a text that appears to come from a highway authority or a transponder company such as E-ZPass, with an unpaid toll, a late fee of $50 and a payment link. The FCC page, updated on 5 May 2025, names E-ZPass in the mid-Atlantic and Northeast, FasTrak in California and I-PASS in Illinois as the services imitated, and says the texts claim an unpaid toll or a balance, with the account to be suspended unless payment is immediate. The FCC also notes that cash-free toll lanes are spreading, so a driver in a new area, covered by a different operator, may not be sure of having paid electronically.

The FTC’s alert of 17 January 2025 says scammers are pretending to be tolling agencies from coast to coast. It says the text might show a dollar amount and a link to a page where you enter bank or card details, and that clicking could give away personal information, such as a driver’s license number.

The wording of the threat is where the sources differ. The FBI’s sample warns of a late fee. AARP quotes a variant from the FasTrak name, spelled differently from the real one, that warns of a fine and the loss of your license. The attorney general of Washington, DC, whose office examined more than 50 of these texts sent to residents, describes a threatening tone with a deadline of 12 hours, fines, escalating late fees, suspension of the vehicle registration through the DMV, impoundment, court proceedings and wage garnishment. The office says the texts appear to have been developed and deployed by transnational Chinese cybercrime syndicates and sent millions of times, and it cites the FBI’s 2024 Internet Crime Report for tens of thousands of people filing complaints about toll texts that year. The pages we read do not give a total for the money lost.

Why a small amount can work, and why the state may not match

AARP calls the size of the sums a troublesome twist: the unpaid toll amounts are small enough to seem reasonable, and believable. Melanie McGovern, director of public relations and social media for the International Association of Better Business Bureaus, is quoted saying that some people think the amount is small enough to pay rather than risk the extra $50. That is one expert’s account of why people pay, given to AARP. The pages we read do not say whether the scammers chose the amounts on purpose, so we do not say it either.

For people who do pay, AARP lists three losses at once, which it calls a triple whammy: money paid that was not owed, a link that may expose them to malware and identity theft, and a criminal in possession of the card number.

Matching the state is not reliable either. AARP says, citing the FBI, that scammers often tailor the text to specific states, and that the link is made to impersonate the state’s toll service name. But AARP also says the scammers appear to be casting a wide net: residents of Michigan received texts although Michigan does not have toll roads, and McGovern’s husband received a text purportedly from SunPass, a Florida transponder system, without living or owning vehicles in Florida. The DC attorney general says the District has no tolling authority of its own, and that the most common version on phones with a 202 area code points to a fake site for the Washington State Department of Transportation.

AARP also reports two variants that are not the plain payment text. The Michigan Attorney General’s Office warned of a message impersonating the 36th District Court in Detroit about a civil infraction hearing, with a QR code leading to a site that mimics the Michigan Department of State. In New York, according to the State Thruway Authority alert that AARP cites, E-ZPass holders received emails asking them to download an invoice for unpaid tolls.

What the sender and the link give away

The FCC lists clues in the sender and the wording. The number may be spoofed to look as if it comes from a toll company, or may be an international number, and there may be other phone numbers among the recipients. The greeting may be generic, such as “Dear Customer” or “E-ZPass user”, while the FCC says E-ZPass typically uses the name on the account in a greeting. A request to pay by gift card or wire transfer is, in the FCC’s words, “almost always a dead giveaway”. The FCC adds that the link appears to be an official website but is a phishing site designed to fool you. Our page on spoofed caller ID covers why a familiar number on a screen settles nothing.

The FBI says the link is created to impersonate the state’s toll service name and that the phone numbers appear to change between states. The DC attorney general looked at the links in detail: the first portion mirrors those of the local tolling authorities, while the second half sits on low-use, low-quality domain extensions that the office says are frequently associated with phishing. The office found that the sites behind the texts serve only to extract personal information and card numbers. One fake E-ZPass Maryland page, it says, shows a highway scene from Orlando, misspells “toll” as “tol” and says it cannot give details unless the visitor pays. The pages we read do not name the domains in use beyond the single address in the FBI’s sample.

On the click itself, the sources are not equally cautious. The FTC says that clicking could give the scammer your personal information. A release from Indiana state senators goes further and says that clicking the link alone puts you at risk of data theft, even if you enter nothing. That is the senators’ statement, and the FBI and FCC pages we read do not make the same claim.

The same release lays out the trick in four steps: the message claims to be from Indiana Toll Road, it frames a threat of late fees or loss of a license, it carries a link to a fake website, and the site collects personal and financial information.

What the operators say, and how strongly

The sources use different verbs, and the difference matters when you wonder whether a text could be genuine. The Toll Roads, run by Transportation Corridor Agencies in California, says on its FAQ page that it does not send text messages to non-accountholders and that it will never request payment via text message. Its FAQ answer adds that The Toll Roads is advising drivers to disregard phishing texts that detail a specific outstanding toll amount. The DC attorney general says toll enforcement agencies will never contact you by text to demand payment for an unpaid toll, and quotes the Virginia DMV and DriveEzMD as saying they never request payment by text. The FCC is more careful: it says toll operators typically do not use text messages to collect on overdue accounts and do not use threatening language to rush customers.

Two other wordings are narrower. AARP cites a fraud alert on the FasTrak site saying it does not request payment by text with a link to a website. The Indiana release says the Indiana Toll Road Concession Company does not send text messages or call customers to request sensitive information such as passwords, financial information or personal information. The release comes from state senators, and its sentence is about sensitive details, not about payment. The Toll Roads wording leaves room for texts to customers with an account, and its page gives them a way to check: log in, scroll down the dashboard to account security and click Notification Verification. The pages we read do not describe a way to tell a valid text from a false one for someone without an account.

The FTC and the FCC both say to check with the toll company directly rather than through the text. The FTC says to reach the state’s tolling agency using a phone number or website you know is real, not the information from the text. The FCC says to call customer service or log into your account to look for valid violations or unpaid tolls, to report the text to your toll company if the account is in order, and, if the text names an operator from another state, to find a customer service number online on your own before sending money or details. The DC attorney general lists phone numbers for the Virginia Department of Transportation and Maryland E-ZPass for residents worried about unpaid tolls.

If you tapped, if you paid, and where to report

If you only received the text, the FCC says not to engage: do not reply, including with a Y or an N, and do not click the link. It adds that you can block the number, should not share personal or financial information, and should not let an urgent request bully you. The FTC says to report junk through the phone’s own option or to forward the text to 7726 (SPAM) and, once you have checked it and reported it, to delete the text.

If you clicked a link or gave information, IC3 says to secure your personal information and financial accounts and to dispute any unfamiliar charges. The DC attorney general gives the longer list, written for people who clicked through a scam link and tried to pay with a credit card. It starts with not blaming yourself, because the texts are designed to deceive busy people. Then contact your bank, tell it you have been the victim of a phishing scam and ask for a fraud block or a replacement card, and check your transactions for unauthorized charges. Consider a temporary credit freeze with Experian, TransUnion or Equifax to prevent new accounts being opened in your name. Be wary of follow-up contact: the office says scammers will sell your name and contact details to other scammers over the dark web. Finally, report it to the FTC at ReportFraud.ftc.gov and visit IdentityTheft.gov for a recovery plan. The Toll Roads sends people to IdentityTheft.gov too, and Indiana’s release tells people who clicked to contact the bank and check for unfamiliar charges or freeze the account.

On where to report, the sources do not agree on one place. IC3 asks for the number the text came from and the website listed in it, and the FCC, AARP, the Indiana release and The Toll Roads FAQ also point to IC3. The FTC points to 7726, the DC attorney general and The Toll Roads advisory point to ReportFraud.ftc.gov, and the FCC adds its own complaint form. AARP adds a helpline run by its Fraud Watch Network for victims and family members. Our page on where to report scams goes through the reporting forms, and the parcel text covers the delivery version, which this page leaves aside.

Not covered here

We did not tap any link. We did not read a Facebook post from a county sheriff or a Reddit thread on unpaid tolls. The count of complaints the DC attorney general gives comes from the FBI’s 2024 report, which we did not open, so we only report that the office cites it. The Indiana page is a press release from state senators that passes on a statement from the toll company, not a page from the company itself.