The text says you owe $12.51 in unpaid tolls, warns of a $50 late fee, and helpfully includes a link to “settle your balance.” Maybe you don’t even own a car. Maybe you haven’t driven a toll road in years. The texts come anyway — and in 2026 they are still coming, to phones across all fifty states, years after federal investigators first flagged the scheme.

Here’s the plain truth of it: those messages are not from E-ZPass, SunPass, FasTrak, or your state’s turnpike. They’re a mass phishing operation — “smishing,” in the SMS variety — designed to harvest credit card numbers and personal information a few dollars of fake toll debt at a time. Understanding how it works is the best vaccine, so let’s take it apart.

Anatomy of the con

The FBI’s Internet Crime Complaint Center first warned about the scheme in April 2024, after receiving more than 2,000 complaints in barely a month. The bureau’s alert quoted the template almost every victim received: an outstanding toll of about $12, a threatened late fee, and a link dressed up to impersonate the state’s real tolling service. Only the state name, the phone numbers, and the look-alike web addresses rotate; the script barely changes. The Federal Trade Commission followed with its own consumer alert weeks later, and again in 2025 as the wave kept building coast to coast.

The design is clever in three specific ways. The dollar amount is small, so paying feels easier than investigating. The deadline is immediate, so you act before you think — the FTC’s core observation is that scammers want you to react quickly precisely because stopping to check defeats them. And the premise is plausible: modern tolling is cashless and camera-based in much of the country, so “you drove through a toll and didn’t know it” doesn’t sound crazy.

But the $12.51 was never the point. The payment page’s real harvest is your card number, billing address, and sometimes a driver’s license number — credentials that get used for real fraud or resold. The Federal Communications Commission’s consumer guide on toll-scam texts notes the same pattern: the texts impersonate legitimate tolling agencies while routing victims to fraudulent payment sites.

Why your phone specifically? It isn’t.

People ask how the scammers knew they drove a toll road, or knew their state. Usually, they didn’t. These campaigns blast texts at enormous lists of phone numbers — bought, leaked, or simply generated in sequence — and let area codes do the targeting: send a million “Pennsylvania Turnpike” texts to 215 and 412 numbers, and enough recipients will have actually driven the turnpike recently to make the con land. If you got one for a state you’ve never visited, you’ve seen the machinery slip.

That’s also why the texts won’t stop. Bulk SMS is nearly free, the kits that build fake toll sites are sold ready-made, and the operation only needs a tiny response rate to profit. Carriers and registrars shut domains down; new ones appear the same week. This scam ends when it stops paying, not before — so assume every unpaid-toll text is fake until proven otherwise.

The two-step response that always works

Step one: don’t click, don’t reply, don’t call the number in the message. Replying — even “STOP” — confirms your number is live and gets you more scams, not fewer.

Step two: if any part of you wonders whether you really do owe a toll, check the only way that’s safe — go around the text entirely. Type your tolling agency’s real website into your browser yourself, log into your account there, or call the customer-service number printed on your transponder statement or the agency’s official site. That’s the FBI’s own recommended procedure, and it costs you ninety seconds. A real toll balance will be sitting in your real account; a scam evaporates the moment you refuse to use its link.

Then report and delete: forward the text to 7726 (SPAM), which helps carriers block the sender, use your phone’s “report junk” button, and file at ReportFraud.ftc.gov or ic3.gov. Reports are how investigators map the campaign’s domains and mule accounts.

If you already clicked — or paid

Clicking alone is usually survivable; entering information is what stings. If you gave a card number, call the card issuer now, dispute any charges, and request a replacement card — fraudulent card charges carry strong federal dispute protections, and small “test” charges often precede bigger ones. If you entered bank details, call your bank. If you typed a password you use elsewhere, change it everywhere it’s reused. Then keep an eye on your credit reports — you can pull them free every week at AnnualCreditReport.com — and consider a fraud alert or freeze if a Social Security or license number was involved.

One last thing worth saying at the kitchen table: getting fooled by this one carries zero shame. The texts are professionally built, the amount is trivially believable, and they arrive while you’re distracted. The defense isn’t being smarter than the scammer — it’s having one unbreakable rule: money and personal information never go through a link that arrived unrequested. Tolls included.

This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.