That E-ZPass Unpaid Toll Text Is Lying to You

You are standing in line at the grocery store when your phone buzzes. Your E-ZPass account has an outstanding balance, the text says, and your driving privileges will be suspended in 24 hours unless you pay now. There is a link. One quick tap to make it go away. That tap is exactly what a fast growing criminal network is counting on.

This is the unpaid toll text scam, and if you drive, commute, or simply own a smartphone, you have probably received one already. It has become one of the most reported text scams in the United States, and it is a big reason imposter scam losses keep climbing.

I am Nitesh Kumar Gupta, founder and editor of The Scam Exposed. In this guide I explain what these texts say, how the machinery behind them works, what happens to your money and data if you click, and the simple steps that keep you safe. I also show you how to check, safely, whether you really owe a toll, because sometimes you do.

In this article (15)

1. What the text actually says
2. How big the problem is
3. Why it is working so well
4. What happens if you click
5. Why your uncertainty is the target
6. Rental cars and travel
7. A typical case
8. Red flags
9. Real toll notice vs scam text
10. How to check if you really owe a toll
11. How to protect yourself
12. If you already paid or clicked
13. Quick quiz
14. FAQ
15. How we researched this article

What the text actually says

The wording changes a little from state to state, but the pattern is almost identical everywhere. A message arrives claiming to be from E-ZPass, SunPass, FasTrak, TxTag, or whichever toll authority operates near you. It says you have an unpaid toll from a recent trip, that a late fee is building up, and that if you do not pay by a specific date, usually within one to three days, your license will be suspended or your vehicle will be reported to a collections agency.

A link sits right below the threat. It is often shortened through a service like bit.ly, or uses a lookalike domain such as ezpass-nowpay.com or sunpass-account-verify.net. Some versions add a small amount, like 4.15 dollars or 6.99 dollars, to make it feel too small to argue over.

Everything about the message is built to make you act before you think. There is a deadline. There is a consequence. There is a link that promises to make the problem disappear in under a minute. What there almost never is, is your name. Real toll authorities that have your account on file address you by name, not Dear Customer or Valued Driver.

Common phrases used in these texts

• Your vehicle has an unpaid toll balance. Pay now to avoid a late fee.
• Final notice: failure to pay will result in license suspension.
• We have noticed an outstanding toll charge on your account.
• Reply Y and reopen this message to activate the link.

Any of these, arriving out of the blue by text, should be treated as a scam until you have checked your real account yourself.

How big the problem is

The Federal Trade Commission has reported that fake toll payment texts became the single biggest driver behind a 40 percent jump in government imposter scam reports. More than one million imposter scam complaints were filed in total, and this one scheme accounts for a significant share of them. Imposter scams overall pushed reported losses in the United States past 3.5 billion dollars in 2025.

The FCC has published its own consumer warning about toll road payment scam texts, and toll authorities in many states have posted alerts on their websites. Researchers at Bitdefender Labs have tracked the campaign under the name Operation Road Trap.

Why this scam is working so well right now

Researchers at Bitdefender Labs found that Operation Road Trap is not a single criminal but a widespread, coordinated network using shared tools and tactics. It is not tied to one country or one group. It behaves like a franchise, with different criminal cells running the same playbook on rented infrastructure.

Websites that regenerate faster than they are blocked

The fake websites are refreshed constantly. By the time one domain is flagged and blocked, many new ones have already taken its place. That is why you cannot rely on your phone or browser to warn you about every fake toll page.

Spoofed senders and hidden letters

Sender information is faked so the text can appear to come from a short code your toll authority might plausibly use. Some campaigns swap ordinary letters for similar looking Cyrillic characters inside the fake links. To your eye the word looks normal. To a spam filter scanning for exact matches, it is a different word, so the message slips through.

The reply Y trick on iPhones

Apple's Messages app automatically disables links sent from unknown senders, which should stop you from tapping through to a scam site by accident. The scammers found a workaround. The text asks you to reply with the letter Y, as if confirming you received it. Once you reply, the phone treats the conversation as one you engaged with, and the link can become active. A one letter reply is all it takes to undo a built-in protection.

Instant data theft behind the scenes

Behind some of the larger campaigns, researchers found even more elaborate machinery. In certain operations, stolen data does not sit in a spreadsheet. It is piped through the Telegram Bot API straight to channels the criminals control, often within seconds of you typing your card number. Some versions use Firebase's real time database to remotely control an infected phone, forwarding text messages and redirecting anything that looks like a bank verification code.

What happens if you click

The link takes you to a page clearly designed by someone who has seen a real toll payment portal. The colors, layout, and sometimes the logo are close enough that a quick glance raises no suspicion. The page asks for your license plate, which is often prefilled or easy to guess, then your name, address, and the part that matters most to the scammer: your card number, expiration date and security code.

Some versions add one more step. After you enter your payment details, the page asks you to verify your identity with a one time code that was just sent to your phone. That code is not for a toll payment at all. It is the code your real bank just sent because the scammer is, at that same moment, trying to log in to your online banking or add your card to a digital wallet on their own phone. By entering it, you hand them the final key.

Once the card is in their wallet, they can tap to pay in stores or buy gift cards and electronics anywhere, and your bank sees each purchase as one you approved. That is why the stolen code step is so damaging, and why calling your bank quickly matters so much.

Why your uncertainty is the real target

Toll roads move fast. Cashless tolling systems photograph your license plate and bill you automatically, sometimes days or weeks after the trip. Most drivers do not know their exact toll balance at any given moment, and that small gap in certainty is the entire foundation of this scam.

The message does not need to be convincing on its own. It only needs to land when you cannot immediately rule out that it might be true. Add a countdown clock, and that sliver of doubt is often enough.

Older drivers and people who travel through unfamiliar states are especially vulnerable, since they are the most likely to honestly wonder whether a toll was missed. But younger, tech savvy people fall for it too. The scam has been refined to defeat the instincts that usually protect careful users, including checking for a professional looking website.

Rental cars, road trips and why timing matters

Scammers know when people travel. These texts often spike around holidays, summer vacations and long weekends, when millions of drivers have just used toll roads they do not normally drive. A text that arrives a few days after a road trip feels believable because the timing lines up with real life.

Rental cars add another layer of confusion. Most rental companies have their own toll programs. Some charge a daily fee for a transponder, others bill you later for each toll plus a service charge, and the bill can arrive weeks after you return the car. Because people know rental tolls show up late, a text about an unpaid rental toll seems reasonable. But rental tolls are billed by the rental company to the card you used for the rental, not by a random text with a payment link.

Out of state driving creates the same doubt. If you drove through a state with cashless tolling and do not have that state's transponder, you may get a real bill in the mail sent to the address on your vehicle registration. Real mailed notices include your plate number, the date, time and location of each toll, and instructions to pay through the official website. They do not threaten to suspend your license tomorrow.

The practical lesson is simple. A recent trip makes a toll text feel more believable, but it does not make the text more real. The safe check is always the same: go to the official site or app yourself, or call the rental company on the number from your agreement.

A typical case

The following is a typical case that shows the common pattern. It is not a specific real person.

A man in his forties drives a rental car through three states on a family vacation. A week after getting home, he gets a text saying he owes 6.99 dollars in unpaid tolls and a 50 dollar late fee will be added tomorrow. It sounds plausible, because he did drive on toll roads in a rental. The text says to reply Y to activate the payment link. He replies, taps the link, and sees a neat payment page with a state toll logo.

He enters his plate, his name and his debit card. The page then asks for a verification code sent to his phone. A text arrives from his bank with a code. He enters it, sees a payment confirmed message, and moves on.

The next morning his banking app shows several purchases at electronics stores in another city, made with a phone wallet he never set up. The code he typed was the bank's code for adding his card to a new device. He calls his bank, which freezes the card and opens a dispute, but the process takes weeks and he has to replace the card on every account where it was saved.

Red flags

• It threatens license suspension within hours or days. Real toll violations go through mailed notices and a longer legal process.
• It does not use your name. Real accounts know who you are.
• It asks you to reply Y. This is the trick to activate links on phones that block them.
• The link is shortened or slightly off. Extra words like pay, now, verify or account added to a toll brand name are a giveaway.
• It comes from a personal looking phone number or email address. Many arrive from random numbers or iMessage email addresses.
• It asks for a code after you enter your card. That code is from your bank, not the toll agency, and should never be shared.
• The amount is tiny. Small amounts are chosen so you will not bother to check.
• It names a toll agency from a state you have not driven in. These texts are sent in bulk to random numbers.

Real toll notice vs scam text

How to check if you really owe a toll

Sometimes you do owe a toll, and it is fair to want to settle it. Here is how to check safely:

1. Ignore the text completely. Do not tap, do not reply.
2. Find the toll authority yourself. Use a past bill, the back of your transponder, or type the agency's name into your browser and pick the official site, not an ad.
3. Log in to your account through that official site or the official app, and look at your balance and history.
4. For rental cars, check with the rental company directly using the contact details on your rental agreement.
5. If you have no account, many toll agencies let you look up a plate on their official site to see unpaid tolls.
6. Call the number on the official site if you are still unsure. Explain you got a text and ask whether anything is owed.

If a violation exists, you will see it and can pay it safely through that verified route. If nothing is there, the text was a scam.

How to protect yourself

1. Never tap links in unsolicited toll texts, a rule the FCC also recommends.
2. Never reply, not even STOP or Y. A reply confirms your number is active and can unlock blocked links.
3. Forward the text to 7726 so your carrier can investigate, then delete it.
4. Turn on spam filtering for messages on your phone, such as filtering unknown senders.
5. Never share a code sent by your bank with any website or caller.
6. Set up your toll account alerts in the official app so you know what real notices look like.
7. Use a credit card rather than a debit card for online payments where you can, since credit cards usually offer stronger dispute rights.
8. Tell family members, especially older relatives and new drivers, about this exact text.

For more on dangerous texts, see our guides to the 7 common scam texts and the 5 scam texts to know in 2026. If a package you did not order shows up with a QR code, read our brushing scam guide. And for the pattern that ties every scam together, see how to spot any scam in 2026.

If you already paid or clicked

If you entered a one time code as well as your card, treat every account linked to that phone number as possibly at risk. Start with online banking and change passwords from a device you trust.

1. Call your bank or card issuer right now using the number on the back of your card. Ask them to block the card, stop or reverse any pending payment, and flag the account for fraud. Speed matters more than anything else.
2. Ask your bank to check for digital wallets added to your card in the last few days, and remove any you did not set up.
3. Report the text by forwarding it to 7726 and filing at the FCC Consumer Complaint Center.
4. Report it to the FTC at ReportFraud.ftc.gov. Your report goes into the Consumer Sentinel database used by law enforcement across the country.
5. Report it to the FBI at IC3.gov, especially if money was taken. Include dates, amounts, phone numbers, links and screenshots.
6. If personal details were exposed, create a recovery plan at IdentityTheft.gov and consider a free credit freeze with Equifax, Experian and TransUnion.
7. If you are 60 or older, or helping someone who is, call the National Elder Fraud Hotline free at 1-833-372-8311. A case manager can walk you through every report.
8. Keep a written log of every call, text, website and payment. Banks and investigators move faster when the facts are in one place.

Quick quiz: scam or not?

A text says your SunPass balance is 4.15 dollars and asks you to reply Y to get the payment link. Scam or not?

Scam. The reply Y request is a known trick to activate links your phone has blocked. Toll agencies do not ask this.

You open your official E-ZPass app and see a notice about a low balance with an option to top up. Scam or not?

Not a scam. You reached it by yourself through the official app. That is the safe way to check and pay.

After paying a toll on a website, it asks for the code your bank just texted you. Scam or not?

Scam. A toll payment never needs your bank's one time code. That code lets the criminal log in or add your card to their phone.

Frequently asked questions

Help us warn others

Got this call or message? Search the number on The Scam Exposed and leave a comment on its page to warn others. Every comment helps the next person who looks that number up before calling back.

Share this with a parent or grandparent. A two minute read today can save a family thousands of dollars tomorrow. Scammers count on people not talking about this, so talking about it is one of the best defenses we have.

How we researched this article

This article uses public information from the FTC Consumer Advice site and FTC consumer alerts, the FCC toll text warning, the FBI Internet Crime Complaint Center, and research from Bitdefender Labs on Operation Road Trap. The typical case is a composite of the common pattern, not a specific person. We review this guide when new warnings are published.

This article is for general information and awareness only and is not legal or financial advice. If you think you owe a real toll, check directly with your toll authority using contact details you find yourself.