How to Protect Yourself From Toll and EZPass Text Scams

Toll road text scams have become one of the most widespread smishing attacks hitting Americans in 2025 and 2026. You receive an urgent text claiming you owe an unpaid toll balance — often just a few dollars — with a link to pay immediately or face steep fines. The message looks official, the amount seems plausible, and the pressure to act fast is real. But it's a scam, and clicking that link can expose your financial accounts and personal data to criminals. Here's everything you need to know to protect yourself.

How Toll Text Scams Work

Toll road scams follow a predictable pattern designed to exploit trust and urgency. A text message arrives on your phone claiming to be from a toll agency — EZPass, SunPass, TxTag, FasTrak, or your state's toll authority. The message states you have an unpaid toll balance (usually a small, believable amount like $3.45 or $6.70) and that failure to pay will result in excessive fees, license suspension, or even legal action.

The message includes a link that appears to lead to an official government or toll agency website. In reality, the link goes to a fraudulent site controlled by scammers. Once there, victims are prompted to enter their name, address, credit card number, and sometimes their driver's license or Social Security number to "pay" the fake toll. The scammers capture this information and use it to commit financial fraud or sell it on the dark web.

Why the FBI and FCC Are Warning About These Scams

Toll text scams have become so pervasive that both the FBI and the Federal Communications Commission have issued formal warnings. The FCC maintains a dedicated resource page — "How to Spot and Avoid Toll Road Payment Scam Texts" — describing exactly how these scams operate and what consumers should do to protect themselves.

The FBI has documented thousands of complaints from victims in states across the country, with losses ranging from hundreds to thousands of dollars per victim. The scale of these campaigns is enormous: scammers send millions of toll scam texts simultaneously, targeting people in states they may not even live in or drive through. If even a small fraction of recipients click and comply, the criminals profit substantially.

Red Flags to Watch For

Toll scam texts have become increasingly sophisticated, but they still share common characteristics that reveal their fraudulent nature:

Suspicious URLs

The links in toll scam texts are one of the clearest giveaways. Look for domain names that end in unusual extensions like .gov-info, .toll-pay.com, or combinations that seem official but aren't. Scammers frequently use foreign country code domains (such as .cn, .ru, or .xyz) appended to toll-sounding names. Legitimate toll agencies use simple, well-known domains — ezpassny.gov, sunpass.com, txtag.org, bayareafastrak.org. If the URL in the text doesn't exactly match the agency's known official website, don't click it.

Urgent Language and Threats

Scam texts almost always create artificial urgency. Phrases like "Pay within 24 hours," "Your account is overdue," "Avoid excessive fees," or "Legal action may be taken" are designed to short-circuit your critical thinking. Legitimate toll agencies provide ample time to resolve balances and notify you by mail first — they don't threaten immediate consequences via text.

Texts That Look Surprisingly Legitimate

Modern toll scam texts are often well-written and free of the typos and grammar errors that once made scam messages easy to spot. Scammers use AI tools to craft convincing messages and professional-looking fake websites. The message may include your general state or region to seem locally relevant. Don't assume a well-written text is legitimate.

Texts From Local-Looking Numbers

Toll scam texts increasingly arrive from US-based numbers with familiar local area codes rather than international numbers or short codes. This is intentional — scammers use number-spoofing technology to appear local and trustworthy. A local area code does not indicate a legitimate sender.

Small Dollar Amounts

Scammers typically claim you owe a small, believable amount — often between $2 and $15. A small balance feels more plausible than a large one, and many people figure it's not worth questioning. The goal isn't to collect the toll — it's to capture your full payment card details, which are worth far more to criminals than the fake balance they claim you owe.

Which Toll Agencies Are Being Spoofed?

Scammers impersonate toll agencies across the United States, including:

• EZPass — the multistate electronic toll collection system used across 19 states in the Northeast and Midwest
• SunPass — Florida's statewide toll program
• TxTag — Texas's toll transponder system
• FasTrak — California's Bay Area toll program
• State-branded toll authorities in Illinois, Ohio, Pennsylvania, New York, New Jersey, and many others

Scammers don't know which toll systems you actually use. They send mass messages hoping to reach people in relevant states, or they simply send to everyone knowing some recipients will have used a toll road recently and assume the text is legitimate.

What to Do If You Receive a Toll Scam Text

1. Do not click the link — even just visiting the page can trigger malware downloads on some devices
2. Do not reply to the message — responding confirms your number is active and invites more scam attempts
3. Verify independently — if you're concerned about an actual toll balance, visit the official toll agency website directly or call their customer service line
4. Block the sender — use your phone's built-in blocking feature to prevent further messages from that number
5. Forward the text to 7726 (SPAM) — this reports the message to your mobile carrier's anti-spam systems
6. Report to the FTC — file a report at reportfraud.ftc.gov so the agency can track and pursue the scammers
7. Delete the message — remove it from your phone so you don't accidentally tap the link later

What to Do If You Already Clicked the Link

If you tapped the link in a toll scam text, take these steps right away:

1. Close the browser immediately — if you landed on a fake website, don't enter any information and close it right away
2. Run a security scan — use your phone's built-in security features or a trusted security app to check for malware
3. Contact your bank — if you entered any payment information, call your bank or card issuer immediately to report potential fraud and request a new card
4. Change your passwords — especially for any accounts tied to the email address or phone number you use
5. Enable two-factor authentication on your financial accounts
6. Freeze your credit — if you entered your Social Security number, driver's license, or other identity documents, freeze your credit at all three major bureaus: Equifax, Experian, and TransUnion
7. Monitor your accounts — watch your bank and credit card statements for unauthorized transactions over the coming weeks
8. Report the incident — to the FTC at reportfraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov

How Your Phone Number Ends Up in Scammers' Hands

You might wonder: how did these scammers get your phone number in the first place? The answer is almost always data brokers. These companies collect personal information — your name, home address, phone number, email address, and more — from public records, loyalty programs, app permissions, and commercial data sources. They then compile this data into searchable profiles and sell access to anyone willing to pay.

Scammers purchase phone number lists in bulk from data brokers or scrape them from people-search sites that publish your contact information openly. The more places your phone number appears online, the higher your chances of ending up on a scammer's contact list. This is why the same number often receives multiple types of scam texts — once it's in one list, it spreads to others.

PrivacyOn fights this at the source by automatically removing your personal information — including your phone number — from over 100 data broker and people-search sites. With continuous monitoring and re-submission of removal requests, PrivacyOn keeps your data out of the databases that fuel toll scams, smishing attacks, and other forms of targeted fraud. Fewer data brokers holding your phone number means fewer scam texts reaching your device.

How to Reduce Your Exposure Going Forward

• Remove your phone number from data broker sites — this is the most effective long-term step you can take to reduce unwanted contact from scammers
• Use a secondary phone number — apps like Google Voice provide a secondary number you can use for signups, reducing exposure of your primary number
• Enable spam filtering on your phone — iOS and Android both offer built-in spam detection for text messages; make sure yours is turned on
• Sign up for official toll notifications — if you use a toll system regularly, register with the official program so you know what legitimate communications look like
• Be skeptical of any unsolicited payment request — whether by text, email, or phone call, treat any unexpected payment demand as suspicious until you've independently verified it