Toll scam texts are flooding phones nationwide, posing as E-ZPass, SunPass, or other toll services and claiming you owe money. These texts appear simple and straightforward, just click a link to pay your bill, but they hide a sophisticated threat – one that can steal your money, your identity, and even your bank account.
You’re driving home from a weekend trip, brain in a post-travel fog, and then your phone buzzes with a new text message:
“Toll violation, substantial fines and penalties pending! Vehicle registration suspension possible! You may be prosecuted and your credit score will be affected. Pay now.”
You stop for a moment and think. Maybe you did miss a toll somewhere. Did E-ZPass glitch or try to charge the wrong card? It feels urgent and before you know it, you’re halfway through the message, hovering over the link.
That’s the moment the scammers are waiting for.
Why Toll Scams Work
Toll scams are designed to blend into the noise of everyday life.The messages sound plausible, and if you’ve been traveling recently, the idea that you might owe a few dollars to a toll agency doesn’t sound completely out of the question. These scams don’t appear to be particularly sophisticated or high-tech, but they’re believable enough in the right distracted moment.
But if you take a closer look, the cracks start to show. The message may come from a weird email address or international phone number, contain broken grammar, and include over-the-top threats that are meant to scare you into clicking before you can think it through.
It’s easy to assume the victims of these scams must be careless or gullible, but that’s not necessarily the case. Toll scams are designed to exploit the way people think and react when they’re busy, stressed, and distracted. That’s most of us.
Breaking Down the Toll Scam Text
Chances are, if you own a mobile device, you’ve received one of these toll scam texts, or one of the related package delivery scam texts. Scammers impersonate a wide range of real toll agencies, State Departments of Transportation, and State DMVs. Some (but not all) of these include:
E-ZPass (multi-state system covering several East Coast states including NY, NJ, PA, MA, DE, VA, MD, OH, IL, etc.)
SunPass (Florida)
TxTag / NTTA (Texas)
FasTrak (California)
Peach Pass (Georgia)
RiverLink (Indiana and Kentucky)
K-Tag (Kansas)
Pikepass (Oklahoma)
Here are some actual toll scam messages currently making the rounds, submitted to our investigations team:
Toll scam texts typically follow a similar pattern:
1. Sent from a weird phone number or email
Toll agencies will never send out toll violation notices from random email addresses or phone numbers, especially phone numbers with international area codes! If you owe a toll payment, most agencies will send a bill in the mail, not a threatening text message with a link.
2. Stacked threats
“Substantial fines” “Registration suspension” “Vehicle impoundment” “Wage garnishment” “Credit score impacts” “Legal action”
Scammers stack on every dramatic, life-ruining consequence they can think of in a single message to overwhelm you into action. Real toll agencies don’t operate like that. They want you to pay, not panic.
3. Urgency overload
“FINAL NOTICE” “This is your LAST WARNING” “ No further notices will be sent”Toll agencies will not send you a threatening message yelling in all caps or use language that cuts you off. These words create an urgent situation, one where victims feel pressure to act before it’s too late. Real toll agencies contact you through the mail and give multiple chances to resolve any issues.They want to stay in contact with you so they can get their payment.
4. The fake link:
At first glance, the link in this message looks like it might belong to SunPass. Phishing links are designed to look like the real thing and often contain the name of the toll agency. If the sender is unknown, never click on the link regardless of whether you think it’s real or not. Visit the official toll agency website directly instead.
Taking a look at the link: https://sunpass.com-optr.win/us
Pay close attention to the end of the link – this is where the real domain hides. The real domain here is com-optr.win which has absolutely nothing to do with SunPass or tolls. Watch out for shortened links, misspelled, or slightly altered domains. Look for unusual endings like .xin, .top, .win, .world, .vip, .live, .cyou, and .cfd
5. Reply “Y”
Any message that instructs you to reply, reopen the link, or follow steps to activate the payment portal should be a red flag. These are techniques that scammers use to avoid spam filters. Apple, for example, specifically bans links in iPhone messages received from unknown senders, but by getting you to reply “Y” and reopen the message, that protection is bypassed.
Replying also confirms to the scammer that your number is active and you’re paying attention which can make you a target for future scams.
What Happens If You Click the Link?
To give you an inside look at a toll scam, we clicked on a bunch of toll scam links so you don’t have to. Seriously, don’t click the links. Not only can some of these websites try to download malware that can compromise your device, but the scammer can capture anything you type, even if you never hit submit.
The Fake Website
Clicking the link leads you to a fake website that mimics the real toll agency site. Logos, colors, fonts, and overall layout all look right, but are built with a phishing kit, often the same ones used in package delivery scams. We opened one pretending to be E-ZPass and you can see how it copies the logo and colors of the real toll agency.
Entering “real” information
You’ll be prompted to complete a payment form that asks for information like your name, address, email, and phone number. Some forms even asked for license plate number, driver’s license, date of birth, and Social Security number.
To make a payment, you’re asked to enter your credit or debit card information. The payment amount is usually small, under $20, to avoid raising suspicion.
On some of these scam websites, information is captured as you type it and is sent straight to the scammers, even if you don’t hit submit. That means that if you enter all your personal or payment information, then realize it’s a scam and close out, they can still have your information. Victims may not notice the damage right away, but weeks or months later, long after the toll charge has been forgotten, they may be dealing with large fraudulent charges or identity theft issues.
We entered the payment information using a restricted privacy card so we could see how long it took scammers to try to use it – in this case, it took less than an hour. Some scammers are more patient, waiting a period of weeks or months to “age the card” before trying it, hoping that you won’t link the fraudulent charges to the toll payment you made.
Here’s where things started to get interesting. We were then redirected to a page that looked like PayPal’s secure checkout and asked to input personal and payment information again. We’re not sure why this happens twice, but it may be a tactic to make the payment process feel more “secure” and trustworthy.
The Verification Code Trick
Once we clicked the Pay button, we were hit with this:
We were prompted to enter a 6-digit verification code sent to our phone, but this isn’t just a random code. It’s a real, one-time passcode the scammers triggered by trying to add our card to their mobile wallet. If you enter the code, they can link your card to their mobile device or set up access to the bank account attached to the payment card.
When we typed in the code, we were bounced back to the fake PayPal screen.
Of course, our card showed as “declined”. The scammers might have been hoping we’d try again, perhaps with a different card this time.
How Widespread Is This Scam?
The investigations team at Seraph Secure has received hundreds of reports about these scams with some people reporting a few every week. It’s a nationwide problem that floods our phones and inboxes. The FBI issued a warning in April 2024 about these scams, and a little over a year later, it seems not much has changed.
Since then, many states have issued their own warnings. The Massachusetts Department of Transportation (MassDOT) consumer alert from June 2024 stated that the “targeted phone numbers seem to be chosen at random and are not uniquely associated with an account or usage of toll roads.” In other words, you don’t have to use a toll to be a target.
Michigan’s Department of Transportation (MDOT) issued a press release in April 2025 reminding drivers that government agencies “will never demand money through email, over the phone or text. They will mail you a notice and offer payment options.”
These scams are part of large, coordinated crime networks that change tactics and targets frequently which makes them difficult to track and shut down. Ford Merrill, the Senior Director of Research and Innovation at SecAlliance, is a leading expert on these smishing attacks and the groups carrying them out. In a presentation given at The Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG), Merrill stated that the same SMS-based phish kits used in USPS scams are now being used in toll scams. It’s a tactic: switch the theme, recycle the kit, and keep hitting new victims.
How to Protect Yourself from Toll Scams
Check the sender. Most legitimate toll agencies won’t contact you via text message, especially for billing issues. If they do, the messages will never come from random personal emails or international numbers.
Don’t click links in emails or texts. If you receive a communication from a toll agency, go directly to their official website (not through links in the message) to check for any unpaid fees.
Never reply to suspicious messages. That includes simple responses like “Y” or “STOP”. Forward them to 7726 (SPAM), block the sender, and delete the message.
Watch for urgent language. Toll scams try to create a sense of urgency with alarming language and threats if you don’t comply. Real toll agencies do not threaten or pressure you like this.
Scammers are counting on you speeding past the red flags of these toll scams. Every fake text or email is a potential gateway for them to steal your money and even your identity. But now that you know what to look for, you’ve already taken away some of their power. If you get a text about a toll charge, remember:
It’s not real
Don’t be tempted to click the link
Block the sender and delete the message
Then go one step further: talk about it. Tell your friends, family, neighbors, and coworkers. One quick conversation could help stop someone from getting scammed.
We all expect a few bumps on the road, but scammers trying to charge you for fake tolls? That’s one roadblock you can easily avoid!
– The Seraph Secure Team
