The Fake Toll Road Text Scam: Don’t Tap That Link

You check your phone and see a text message from what looks like a legitimate toll road authority: “We have detected an unpaid toll. To avoid a late fee, please pay immediately at [link].” The message may even include your state’s transportation department logo or a realistic-looking sender name. If you’re over 45, you likely use a toll road, bridge, or express lane at least occasionally. That familiarity is exactly what scammers are counting on. This is one of the fastest-growing smishing attacks in 2024 and 2025, and it is costing people real money.

Smishing—SMS phishing—is a text message designed to trick you into clicking a malicious link or giving up personal information. The fake toll road scam is a textbook example. The message creates urgency: you owe a small fee, and if you don’t act fast, the penalty will balloon. The link takes you to a website that looks like an official payment portal. It asks for your credit card number, expiration date, CVV, and often your billing ZIP code. If you provide that information, the scammer now has your full credit card details. They can drain your account, make fraudulent purchases, or sell your information on the dark web.

Why do these scams work so well on people in their 50s and 60s? First, you grew up trusting official-looking communications. A letter from the government or a bill from a known vendor was a straightforward transaction. The digital world was added later, and you’ve learned to be cautious, but scammers have gotten very good at mimicking familiar brands. Second, you are likely managing household finances, retirement accounts, and even helping aging parents navigate their own bills. The mental load of keeping track of multiple toll accounts, payment plans, and credit cards makes you more vulnerable when a plausible—and urgent—notice appears. Third, scammers know that adults in this age bracket tend to be less familiar with the exact protocols of digital payment systems. You may not know, for example, that legitimate toll agencies almost never send unsolicited texts with payment links. They send bills by mail or through a dedicated app or website that you log into directly.

The toll road smishing attack is particularly dangerous because it preys on a common, mundane hassle. You’ve probably forgotten to pay a toll before. Maybe you had a rental car and the plate wasn’t updated. Maybe you drove through a cashless lane and missed the sign. The scammer’s message taps into that memory of uncertainty. You think, “That could be real.” And because the amount is small—usually $3 to $12—you don’t think twice before pulling out your credit card. But the real cost is not the toll fee; it’s the full access you’ve just handed over to a criminal.

How can you spot this scam? Look for red flags that are consistent across all smishing attempts. The sender number is often a random string of digits, not a short code or a name you recognize. The message may contain spelling or grammar errors, though many are now polished by AI. The link, if you examine it closely, will not lead to an official government domain like “dot.state.us” or “ezpass.com.” Instead it will be something like “ezpay-now.secure-login.xyz” or “tollsnotice.net.” Legitimate agencies rarely—if ever—demand payment via a text link. They will instruct you to log into your account through a browser or app you already use. And real toll authorities will send you a notice through your account profile, not a cold text.

If you receive such a message, do not tap the link. Do not reply “STOP” or any other command—that only confirms your number is active. Delete the text immediately. If you have a genuine toll account, open your own browser, type the official website URL manually, and check your balance there. If you think you might actually owe money, call the customer service number listed on the agency’s genuine website. Never use a phone number provided in the suspicious text.

What if you already clicked the link and entered your credit card information? Act fast. Call your credit card issuer immediately. Tell them you may have been the victim of a smishing scam. They can cancel the card, issue a chargeback for any unauthorized transactions, and monitor for further fraud. Then go to the official website of the toll authority and report the scam to their fraud department. Also file a complaint with the Federal Trade Commission at reportfraud.ftc.gov. Finally, consider placing a fraud alert on your credit reports. Scammers often sit on stolen data for weeks or months before using it, so early action can stop them from opening new accounts in your name.

The fake toll road text is just one variation on a theme. Similar smishing attacks impersonate banks, package delivery services, Netflix, and even the Internal Revenue Service. The tactic is always the same: create a false sense of urgency, mimic a trusted source, and direct you to a fake login or payment page. The defense is also always the same: never trust an unsolicited text that asks you to click a link. When in doubt, go directly to the source. A few extra seconds of caution can save you from months of headache and hundreds or thousands of dollars lost.

You’ve worked hard for your money. Don’t let a three-dollar toll notice trick you out of it. Scammers are counting on your politeness and your habit of paying bills on time. Break that habit when it comes to unsolicited texts. Be suspicious. Verify. And delete.