Your Phone Says You Owe a Toll and That Text Is Lying to You

You are standing in line at a grocery store when your phone buzzes. The message says your E-ZPass account has an outstanding balance and your driving privileges will be suspended in 24 hours unless you pay immediately. There is a link. Your first instinct might be panic, then a quick tap to settle it and move on with your day. That single tap is exactly what a fast growing criminal operation is counting on, and in 2025 alone it helped drive imposter scam losses in the United States past 3.5 billion dollars.

This is the unpaid toll text scam, and if you drive, commute, or even just own a smartphone, you have probably already received one.

What the text actually says

The wording changes slightly from state to state, but the pattern is almost identical everywhere. A message arrives claiming to be from E-ZPass, SunPass, FasTrak, TxTag, or whichever toll authority operates near you. It says you have an unpaid toll from a recent trip, that a late fee is accumulating, and that failure to pay by a specific date, usually within one to three days, will result in your license being suspended or your vehicle being reported to a collections agency. A link sits right below the threat, usually shortened through a service like bit.ly or a lookalike domain such as ezpass-nowpay.com or sunpass-account-verify.net.

Everything about the message is built to make you act before you think. There is a deadline. There is a consequence. There is a link that promises to make the problem disappear in under a minute. What there is not, almost always, is your name. Real toll authorities that have your account on file address you by name, not "Dear Customer" or "Valued Driver."

Why this scam is working so well right now

Researchers at Bitdefender Labs have been tracking this campaign under the name Operation Road Trap, and what they found is not a single criminal but a widespread and coordinated network using shared tools and tactics. The operation is not tied to one country or one group. Instead it behaves like a franchise, with different criminal cells running the same playbook using rented infrastructure.

That infrastructure is genuinely sophisticated. The fake websites are refreshed constantly so that by the time a domain gets flagged and blocked, ten new ones have already taken its place. The sender information is spoofed so the text appears to come from a short code your toll authority might plausibly use. Some campaigns even swap ordinary letters for similar looking Cyrillic characters inside the fake links, a trick that lets the message slip past spam filters that are scanning for exact keyword matches.

There is also a clever workaround for a security feature built into iPhones. Apple's Messages app automatically disables links sent from unknown senders, which should, in theory, stop you from tapping through to a scam site by accident. The scammers found a loophole. The text asks you to reply with the letter Y, as if confirming you received the message. Once you reply, Apple's system treats you as having engaged with a known contact, and the link activates. A one letter reply is all it takes to undo built in protection.

Behind some of the larger campaigns, security researchers have found even more elaborate machinery. In certain operations traced back to India, the stolen data does not just vanish into a spreadsheet somewhere. It gets piped through the Telegram Bot API straight to channels the criminals control, often within seconds of you typing your card number. Some versions go further, using Firebase's real time database to remotely control an infected phone, forwarding your text messages, reading your calls, and quietly redirecting anything that looks like a bank verification code.

What happens if you click

The link takes you to a page that has clearly been designed by someone who has seen a real toll payment portal before. The colors, the layout, and sometimes even the logo are close enough that a quick glance would not raise suspicion. The page asks for your license plate, which is often prefilled or easy to guess, followed by your name, address, and then the part that matters most to the scammer, your card number, expiration date, and CVV code.

Some versions add one more step. After you enter your payment details, the page asks you to verify your identity by entering a one time code that was just sent to your phone. That code is not for the toll payment at all. It is the verification code your actual bank just sent because the scammer is simultaneously trying to log into your online banking or add your card to a digital wallet on their own device. By entering it, you hand them the final key they needed.

The Federal Trade Commission has reported that fake toll payment texts became the single biggest driver behind a 40 percent jump in government imposter scam reports last year. More than one million imposter scam complaints were filed in total, and this one scheme now accounts for a significant share of them.

Why your uncertainty is the real target

Toll roads move fast. Cashless tolling systems photograph your license plate and bill you automatically, sometimes days after the trip. Most drivers genuinely do not know their exact toll balance at any given moment, and that small gap in certainty is the entire foundation of this scam. The message does not need to be convincing on its own merits. It only needs to land at a moment when you cannot immediately rule out that it might be true, and paired with a countdown clock, that sliver of doubt is often enough.

Elderly drivers and people who travel through unfamiliar states are particularly vulnerable, since they are the most likely to genuinely wonder whether a toll was missed. But younger, tech savvy people are not immune either. The scam has been refined specifically to defeat the instincts that usually protect careful users, including the habit of checking for a personalized greeting or a professional looking website.

How to actually protect yourself

The single most reliable rule is simple. Never tap a link inside an unsolicited text about a toll, no matter how official it looks or how urgent it sounds, a rule the FCC also recommends. Toll authorities do not typically demand payment by text message, and none of them threaten license suspension within 24 hours over a text.

If you are unsure whether you owe a toll, close the message entirely and go find the toll authority's number yourself, either from a past bill, the back of your physical transponder, or a quick search for their official website typed directly into your browser rather than clicked from the text. Log into your real account through that verified channel and check your balance there. If a violation genuinely exists, you will see it, and you can pay it safely through the same verified login.

Do not reply to the text at all, not even to say stop or to argue that you do not owe anything. A reply confirms to the scammer that your number is active and monitored by a real person, which makes it more valuable for future attempts, and as mentioned earlier, even a single letter reply can be enough to bypass link protection on some phones.

If you have already entered payment information on one of these fake pages, contact your bank or card issuer immediately and explain exactly what happened. Ask them to flag the card, watch for unauthorized charges, and if needed, issue a replacement. If you also entered a one time verification code, treat every account linked to that phone number as potentially compromised, starting with online banking, and change your passwords from a device you trust.

Finally, report the message. Forward the text to 7726, which spells SPAM on most keypads and routes the message to your mobile carrier for investigation. You can also file a report with the FCC Consumer Complaint Center or the Internet Crime Complaint Center. These reports feed directly into the data researchers and regulators use to track and eventually shut down the networks behind campaigns like Operation Road Trap.

The toll you actually owe, if you owe one at all, will still be there tomorrow, and it will never come with a 24 hour countdown attached. The text demanding you pay it right now is the only part of the message you should trust completely, because it is completely fake.

Sources

• FCC Consumer Complaint Center
• FBI Internet Crime Complaint Center
• FTC Consumer Advice