If you receive a text message about unpaid road tolls, it may be a scam. Contact your state’s toll service or look up their official website (in Google Search) to see if you have an outstanding toll balance. As always, you should not open URLs from unknown senders, even if they claim to be trustworthy.
In a public service announcement, the FBI states that it has received over 2,000 complaints related to a toll collection “smishing” campaign (a phishing scheme performed over SMS). Essentially, scammers are impersonating toll collection services in an attempt to obtain credit card numbers, addresses, birthdates, and names. This information may be used to commit identity theft or draw money from victims’ credit cards.
Complaints related to the scam date back to March 2024—it’s a relatively new thing. Each text message is tailored to impersonate a state’s toll collection service, and the FBI believes that at least three U.S. states have been targeted thus far. Additional states may be targeted in the coming weeks. This scam came to my attention after I received a text message from “SunPass,” Florida’s road toll collection service. The message warned of a $12.51 “outstanding toll amount,” which would incur a $50 fee if I failed to open a URL and pay up. You can see a screenshot of the text message below.
At a glance, this is a pretty convincing text message. The URL looks authentic, nothing is misspelled, and a $50 late fee isn’t out of the realm of possibility. But I haven’t been on a toll road in a few years, I didn’t get a warning in the mail, and I’ve never registered my phone number with SunPass. When I visited the real SunPass website (from Google Search), I found that I had no outstanding fees.
There are also some less-than-obvious problems with this text message. It comes from a Canadian area code, for one, and the URL doesn’t match SunPass’ domain. Upon closer inspection, the scammers’ fake domain was registered on April 15th, and its registrar is located in Hong Kong. Also, SunPass late fees start at $2.50, not $50.
In its PSA, the FBI provides a text message that’s identical to the one that I received. But scammers aren’t just copy-pasting a single message. If you perform a quick search, you’ll find toll-collection scams that utilize a different message format. Do not trust text messages from unknown numbers, and don’t open random URLs that are sent your way. Yes, some toll collection services provide text-based notifications for registered users, but this is the kind of thing that you would normally receive by mail. The same goes for the IRS, in case you’re wondering.
You should report scammy text messages to the FBI’s Internet Crime Complaint Center (IC3). If you fell for this scam, contact your bank and dispute any fraudulent charges. You may also want to set up a fraud alert, as the scammers now have your birth date, phone number, and address. See the FBI’s PSA for additional details.
