How to Protect Yourself From Toll Road and E-ZPass Text Scams

You receive a text message claiming you have an unpaid toll balance. It looks official -- mentioning E-ZPass, SunPass, FasTrak, or your state's toll agency by name -- and warns that failure to pay immediately will result in late fees or a suspended registration. The message includes a link to "settle your balance." It feels urgent, plausible, and legitimate. It is none of those things. Toll road text scams have exploded across the United States, with the FBI receiving over 60,000 complaints by early 2025 and security researchers uncovering more than 100,000 phishing sites impersonating toll agencies. Here is how the scam works, how to protect yourself, and what to do if you have already been targeted.

How the Toll Road Text Scam Works

The scam follows a consistent playbook. You receive an unsolicited text message -- often from an unknown number or short code -- claiming to be from a toll collection agency. The message states that you owe a small amount, usually between $3 and $15, and includes a link to pay. The small dollar amount is deliberate: it feels trivial enough that many people pay without thinking.

The link directs you to a phishing website designed to look like a legitimate toll agency portal. These sites are often sophisticated, featuring official logos, realistic page layouts, and even fake customer service chat widgets. Once you arrive, the site asks you to enter:

• Your full name and address
• Credit or debit card number, expiration date, and CVV
• Sometimes your Social Security number or driver's license number
• Sometimes your login credentials for the real toll agency's website

The scammers are not after your $6.99 toll balance. They want your payment card information, personal identity details, and any credentials they can use for further fraud. Once they have your credit card number, they can make unauthorized purchases, sell your data on the dark web, or use your identity to open new accounts.

Red Flags: How to Spot a Toll Road Scam Text

These scam messages share common characteristics that make them identifiable if you know what to look for:

• Unexpected contact: Legitimate toll agencies rarely send payment demands via text message to numbers they do not have on file. Most communicate through their app, email, or physical mail.
• Urgency and threats: The message warns of imminent consequences -- late fees, license suspension, collections -- if you do not pay right away. Real toll agencies provide written notice with ample time to respond.
• Suspicious URLs: The link in the message does not match the toll agency's official domain. Look for misspellings (e.g., "ezpass-pay.com" instead of the official site), unusual domain extensions (.top, .xin, .win, .vip), or long, convoluted URLs with random characters.
• Generic greetings: The text does not include your name, license plate number, or account number. It uses vague language like "Dear customer" or "Dear driver."
• Request to click a link: The message asks you to tap a link rather than directing you to log in to your account through the official app or website.
• Small dollar amounts: The supposed balance is suspiciously small -- just enough to seem like a minor oversight not worth questioning.

What to Do If You Receive a Scam Toll Text

If you receive a suspicious text about unpaid tolls, follow these steps:

1. Do not click the link. This is the most important step. Do not tap, click, or long-press the URL in the message.
2. Do not reply to the message. Replying -- even to say "STOP" -- confirms to scammers that your phone number is active and monitored, which can lead to more scam messages.
3. Report the message. Forward the text to 7726 (SPAM), which is the number used by most carriers to report spam texts. You can also report it to the FBI's IC3 at ic3.gov and to the FTC at reportfraud.ftc.gov.
4. Delete the message after reporting it to avoid accidentally clicking the link later.
5. Verify independently. If you think you might actually owe a toll, go directly to the toll agency's official website by typing the URL into your browser (not by clicking any link in a text). You can also call the number on the back of your toll transponder or on the agency's official website.

What to Do If You Already Clicked and Entered Information

If you clicked the link and entered personal or financial information, act quickly to minimize the damage:

1. Contact your bank or credit card company immediately. Report the compromised card, request a freeze or cancellation, and ask about any unauthorized charges. Most issuers will reverse fraudulent transactions and issue a new card.
2. Change your passwords. If you entered login credentials on the phishing site, change those passwords immediately -- and change them on any other site where you used the same password.
3. Place a fraud alert or credit freeze. Contact one of the three major credit bureaus (Equifax, Experian, or TransUnion) to place a fraud alert on your credit file. For stronger protection, place a credit freeze with all three bureaus, which prevents new accounts from being opened in your name.
4. Monitor your accounts. Watch your bank statements, credit card statements, and credit reports closely for the next several months for any unauthorized activity.
5. File an identity theft report at identitytheft.gov if your Social Security number or driver's license number was compromised. This creates a recovery plan and provides documentation you may need to dispute fraudulent accounts.

How Scammers Get Your Phone Number

One of the most common questions people ask after receiving a scam text is: how did they get my number? The answer usually involves one or more of these sources:

• Data brokers: Companies like Spokeo, BeenVerified, WhitePages, and dozens of others collect and sell personal information, including phone numbers, often tied to your name and address. Scammers can purchase this data cheaply and in bulk.
• Data breaches: Billions of records have been exposed in data breaches over the past decade. If your phone number was part of a breach, it is likely circulating on the dark web.
• Random generation: Some scammers simply send messages to huge batches of phone numbers, including randomly generated ones, hoping to reach active numbers.
• Social media and public profiles: Phone numbers listed on social media accounts, business directories, or other public-facing profiles can be scraped and used for targeted scam campaigns.

Data brokers are a particularly significant source. These companies aggregate personal information from public records, social media, purchase histories, and other sources, then make it available through people-search websites or sell it in bulk. Scammers do not need sophisticated hacking tools to find your phone number -- they can often buy it for pennies from a data broker.

Reducing Your Exposure With PrivacyOn

You cannot stop every scam text from reaching your phone, but you can make it significantly harder for scammers to find your number in the first place. PrivacyOn removes your personal information -- including phone numbers, home addresses, email addresses, and more -- from over 100 data broker sites. By cutting off the supply of personal data that scammers rely on, you reduce your exposure to targeted phishing campaigns like the toll road text scam.

PrivacyOn does not just submit one-time removal requests. It continuously monitors data broker sites for your information and re-submits removal requests when your data reappears, because data brokers frequently re-list information after it has been removed. This ongoing protection means fewer scam texts, fewer phishing attempts, and less personal data available to criminals.

Toll road text scams are not going away. As long as scammers can cheaply acquire phone numbers and personal data, they will keep sending millions of fraudulent messages. The best defense is a combination of awareness -- knowing how to spot and report these scams -- and proactive data removal to reduce the information that makes you a target in the first place.