| Situation | What the evidence shows | Planning use |
|---|---|---|
| An unexpected text says you owe a toll | An FBI example claims an outstanding toll on your record and threatens a late fee | Treat it as smishing. Do not tap the link, and check your account on the toll service’s own website instead. |
| A text claims to be TxTag and says a balance is due | TxTag does not send emails or texts about balances due. Texts it does send to customers come from 22498 | Treat a balance-due text as fake and look up your account yourself. |
| You tapped the link or typed in details | Personal information and financial accounts need securing, and unfamiliar charges need disputing | Act on the same day, starting with your bank or card issuer. |
| You want to report the message | The FTC and the FBI’s Internet Crime Complaint Center both take online reports | File with one or both, then use your carrier’s spam reporting. |
Figures and guidance above come from the FBI Internet Crime Complaint Center alert and the Texas Department of Transportation warning.
A toll scam text is a smishing message that claims you owe an unpaid toll and pushes you to tap a link; treat it as fake until you check your account through the real toll agency’s website.
The same habits that defeat this scam work against most phone and email lures, and our guide on how to protect yourself from hackers covers them in one place.
What a toll scam text can cost you
The immediate risk is not the small toll the message claims. It is what happens after you tap the link and the page asks for your details. The practical consequences fall into a few groups.
- Stolen card and account details. The link is built to impersonate the state’s toll service name, so the page that opens can look like a real payment portal. Anything you type goes to the scammer.
- Fast account misuse. In a case reported by AARP, a woman who entered her details after a toll text received a fraud alert from her credit union within a day. A quick bank alert like that is your cue to freeze or replace the card, not to wait.
- Malware on the phone. Robokiller, quoted by NPR, says URLs in spam texts often contain malware that can infiltrate your phone when you click them. That makes a tap risky even if you never type anything.
- More targeting. Smishing rose 22% in the third quarter of 2024, according to APWG figures cited by NPR, so a single response can mark you as someone worth messaging again.
The scale of the risk explains why the Federal Trade Commission’s January consumer alert, reported by NPR, put it bluntly: a text about unpaid tolls is probably a scam. Next, the specific signs that let you spot one in seconds.
Red flags that separate a fake toll text from a real one
No single sign is conclusive, but several together make a decision easy. Use this list as a quick check before you do anything else.
- You were not expecting it. Montclair State University’s advice is never to tap links in unexpected texts claiming unpaid tolls. If you have no account or recent trip with that agency, there is nothing to pay.
- A small balance with a penalty attached. The FBI’s example claims $12.51 outstanding and a $50.00 late fee. A modest amount lowers your guard, while the fee creates pressure. A campus warning from Montclair State University describes a similar text claiming a toll of $5.99.
- A link that imitates the agency. The link is created to impersonate the state’s toll service name, and the sender’s phone number changes between states. A familiar-looking name in the link proves nothing.
- A named agency that does not text about balances. TxTag says it sends no emails or texts about balances due, and that texts to its customers come from a specific short code. Check your own toll operator’s published messaging practice before trusting a text.
- A well-known toll brand in a state you may not use. Fake violation texts impersonate agencies such as E-ZPass or the New Jersey DMV, and AARP reports that in California the most common are texts posing as FasTrak Lane. Scammers pick names that are familiar to many people.
If your text matches even one of these, move to verification rather than reading it a second time for clues.
If you clicked the link or replied
Speed matters more than perfection here. The FBI advises that if you clicked any link or provided your information, you should take efforts to secure your personal information and financial accounts. The choices below depend on how far you went.
- You only opened the page. Close it, enter nothing, and check your account through the toll service’s legitimate website. The FBI also suggests confirming with the service’s customer phone number, so find that number yourself on the official site. Do not use the number in the text, because NPR’s reporting advises looking up the company’s number on your own.
- You entered card details. Call your bank or card issuer using the number printed on the card, and dispute any unfamiliar charges. Check recent transactions in your banking app as well.
- You entered a password. Change that password at once on the real site, and change it anywhere else you reuse it.
- Your phone is behaving oddly afterwards. Because links in spam texts can carry malware, follow the full checklist in My Phone Was Hacked — What To Do Now: A Practical 2026 Recovery Checklist – Cubeguard. If you opened the link on a laptop or desktop instead, Your Computer Was Hacked: A Practical Step-By-Step Recovery Plan For 2026 – Cubeguard is the better match.
If you did nothing but read the message, no recovery is needed. Your remaining job is to report it so others are protected.
Where to report a toll scam text
Reporting costs a minute and can help others. You can use several channels, and they do different jobs.
- FTC. TxDOT’s guidance tells recipients to report these messages to the Federal Trade Commission online. This feeds the consumer-protection record on the scam.
- FBI IC3. The same guidance names the FBI’s Internet Crime Complaint Center at ic3.gov. Choose this one especially if you clicked, entered details or lost money, since it is the channel for internet crime complaints.
- Your carrier. Forward the text to the spam reporting short code (SPAM) used by wireless carriers. The next section explains why this matters.
- The toll agency. If the text names a specific operator such as E-ZPass or TxTag, tell that operator through its official website or the number you found yourself, so it can warn its customers.
You can file with the FTC, IC3 or both. Report first and keep the screenshot until you have done so, because the details help the report.
Blocking and filtering these texts
Blocking a single number is a weak defence against this scam, since the FBI notes that sender phone numbers change between states. Blocking the sender in your messaging app still costs nothing and removes that one nuisance, but reporting does more.
NPR reports that the numbers often get blocked at the network level once enough complaints arrive. Each report you send to your carrier is therefore a small contribution to carrier-level blocking that protects people who have never seen the message. Your phone’s unknown-sender filtering and your carrier’s spam tools add another layer, and settings vary by phone and plan, so check what yours offers.
Filters will not catch every message. The habit that holds up is simple: any text that asks you to pay something you did not expect is verified from the outside, by typing the agency’s address yourself or calling a number you looked up.
How the scam works
A toll scam text is a form of phishing delivered by SMS. TxDOT describes such SMS text phishing scams as smishing. The attacker needs nothing more than a list of phone numbers and a believable agency name.
The pattern the FBI describes starts with a message about an outstanding toll balance and a deadline to avoid a late fee. The link is crafted to look like the state’s toll service, and the page behind it collects card numbers, logins or other details. Because the text sender and link change between states and agencies, the same script can appear as E-ZPass in one region and as a California toll collector in another.
That is why the playbook stays the same whatever the brand: do not tap, verify independently, secure anything exposed, and report.
Frequently asked questions
What is the difference between smishing and phishing?
Phishing is the broader scam of tricking people into giving up information, usually by email. Smishing is the same trick sent as an SMS text, which is how toll scam texts reach you.
Is it safe to reply or tap a link to opt out?
No. Experts quoted by NPR say never to click links in an unsolicited text, even to opt out. A reply or a tap can confirm that your number is active.
Should I delete the text after reporting it?
Yes. The FBI advises deleting any smishing texts you receive once they are reported. Take a screenshot first if you plan to file a report.
Will my report get the number blocked?
Often, but not instantly. Numbers frequently get blocked at the network level once enough complaints build up, so a single report is one contribution to that total.
