The Rise of Fake Toll Road Smishing Scams: How to Spot and Stop Them

If you have driven on a toll road recently, you might have received a text message that looks like it came from a toll agency. It says something like “We noticed an unpaid toll on your account. Pay now to avoid a fine.” It includes a link that takes you to a website that looks official. Do not click that link. This is a classic smishing attack, and it has been spreading like wildfire across the country. Smishing—short for SMS phishing—is when scammers use text messages to trick you into handing over your personal information or money. The fake toll road message is one of the most common variants right now, and it is targeting middle-class Americans who use toll roads, bridges, or express lanes. The goal is to get you to enter your credit card number, your bank account details, or even your Social Security number. Once they have that, they drain your accounts or steal your identity.

The scam works because it plays on two things: fear and habit. You get a text that feels urgent. It warns you about a late fee or a penalty if you do not pay immediately. That sense of pressure is deliberate—scammers want you to act before you think. And because many of us are used to getting legitimate alerts from banks, delivery services, and government agencies, we have been trained to trust texts. The fake toll message often looks convincing. It might use the logo of a real toll authority, like E-ZPass or the local transportation department. The link may even start with something that looks official, like “ezpass-usa.com” or “sunpass-pay.com,” but these are phony domains set up by criminals. If you click the link, you will be taken to a page that asks for your personal information. After you fill it out, the scammers have everything they need to commit fraud.

How do you spot a fake toll road smishing attack? First, look at the phone number. Legitimate toll agencies do not send unsolicited text messages from random numbers. They usually communicate through email or postal mail, and if they do send texts, they come from a short code or a recognized number. If the text comes from an area code you do not recognize, or a number that looks like a regular cell phone, it is almost certainly a scam. Second, check the message for typos, awkward phrasing, or generic greetings. Scammers often make small mistakes, like “unpaid toll” instead of “unpaid tolls” or “your account has been flagged” without using your name. Third, never click the link. Instead, open your web browser and go directly to the official website of your toll agency. Log in there to check your account. If there is a real unpaid toll, it will show up in your account dashboard. You can also call the customer service number printed on your toll pass or on the agency’s official website—do not use any phone number in the suspicious text.

If you have already clicked the link and entered information, do not panic. Act quickly. Contact your bank or credit card company immediately and put a fraud alert on your account. Change the passwords for any accounts that use the same email address or password you entered on the fake site. Place a fraud alert with one of the three major credit bureaus—Equifax, Experian, or TransUnion—so that no one can open new credit accounts in your name. You should also report the scam to the Federal Trade Commission at ReportFraud.ftc.gov and to your state’s attorney general. And forward the smishing text to 7726 (SPAM) so that your mobile carrier can block similar messages.

Prevention is the best defense. Never respond to unsolicited texts that ask for personal information. Do not store sensitive information like your Social Security number or credit card numbers in your phone’s notes or messages. Consider using a call-blocking or text-filtering app that identifies known scam numbers. And talk to your family members—especially older relatives who might be less familiar with these tactics—about how to spot smishing. Scammers are constantly updating their methods. The toll road scam is just the latest version of an old trick. Next month it might be a fake delivery notification from a shipping company, or a fake alert from your bank about a suspicious transaction. The pattern is always the same: an urgent text, a link, and a demand for personal information. Recognize the pattern, and you will not fall for the trap.

Remember, if a text feels off, it probably is. Take a breath. Do not click. Verify through official channels. That extra minute of caution can save you hours of financial headache and months of credit repair. Stay alert, stay skeptical, and keep your information to yourself.