TLDR
If you received a text about unpaid tolls from EZ Pass, SunPass, FasTrak, or any toll authority, it is almost certainly a scam. The toll road text scam is the #1 trending smishing attack in 2026. The texts link to fake .com domains designed to steal your credit card information. Legitimate toll agencies do not send payment demands via text message to random numbers.
What the Scam Text Looks Like
The text typically reads something like:
"EZ Pass: You have an unpaid toll of $6.99. Pay within 24 hours to avoid a $50 late fee. Pay here: [fake-link]"
Variations include:
- SunPass (Florida)
- FasTrak (California)
- E-ZPass (Northeast US)
- TxTag (Texas)
- Good2Go (Washington State)
The scammers customize the toll authority name based on your area code to make the text more believable.
Why This Scam Is So Effective
Three factors make this the most successful text scam of 2026:
1. Small Dollar Amount
The "unpaid toll" is always small ($4.99 to $12.99). This is deliberate. People are more likely to pay a small amount quickly than to investigate whether it is real. The threat of a larger late fee ($35-75) creates urgency.
2. Plausible Scenario
Most Americans have driven on a toll road at some point. Even if you think you paid, there is enough uncertainty ("maybe I missed one?") to make you consider clicking.
3. Professional Phishing Pages
The links lead to phishing sites that look identical to real toll authority websites. ScamVerify™ URLhaus data shows:
| Domain Type | Count | Share |
|---|---|---|
| .com domains | 59,876 | 86.7% |
| .net domains | 4,000 | 5.8% |
| .org domains | 3,996 | 5.8% |
Scammers register domains like ezpass-payment.com or sunpass-tollbalance.com, professional-looking .com addresses that pass a quick visual check.
How to Identify This Scam
Check the Sender
Toll authorities send official notices by mail or through their mobile app (if you have an account). They do not send payment demands via random text messages.
Check the Link
Long-press (do NOT tap) the link to preview the URL. Real toll authority domains:
| Authority | Real Domain |
|---|---|
| E-ZPass | e-zpassny.com (varies by state) |
| SunPass | sunpass.com |
| FasTrak | bayareafastrak.org |
| TxTag | txtag.org |
If the link goes to anything else, it is a scam.
Check Your Account Directly
If you have a toll account:
- Open the toll authority's app directly (do NOT use any link from the text)
- Or go to their website by typing the URL yourself
- Log in and check your balance
If there is no unpaid balance in your actual account, the text was a scam.
What Happens If You Click the Link
The phishing page asks for:
- Your name and address
- Your credit card number, expiration, and CVV
- Sometimes your driver's license number
This information is used for credit card fraud within minutes of submission.
What to Do If You Already Entered Information
- Call your credit card company immediately to report the card as compromised
- Request a new card number
- Check for unauthorized charges that may have already posted
- File an FTC report at ReportFraud.ftc.gov
- Forward the text to 7726 (SPAM) to report it to your carrier
What to Do If You Received the Text But Did Not Click
- Do NOT tap the link
- Forward the text to 7726 to report it to your carrier
- Delete the text
- Report to the FTC at ReportFraud.ftc.gov
- Check the URL on ScamVerify to help warn others
FAQ
Do toll authorities ever text about unpaid tolls?
Some toll authorities (like SunPass) do send text notifications if you have opted in through their app or account. The key differences: legitimate texts come from a short code (not a regular phone number), reference your specific account, and link to the official domain. They never threaten immediate penalties via text.
Why am I getting toll texts from a state I have never visited?
Scammers send these texts in bulk to millions of phone numbers. They do not know (or care) whether you actually use toll roads. The small percentage who happen to have toll accounts and click makes the operation profitable.
Can I trace who is sending these texts?
The phone numbers are typically spoofed or use disposable VoIP services. Individual tracing is not practical. However, reporting to 7726 and the FTC helps carriers and law enforcement identify the infrastructure behind the campaign.
