The SunPass Scam: Urgent Alert for Florida Drivers in 2026

Your phone buzzes. A text from “SunPass” says you owe $6.85 in unpaid tolls. Click here or face penalties. Sound familiar? That message is almost certainly a scam, and thousands of Florida drivers are falling for it right now.

The single most important fact to know immediately: Any SunPass text that is legitimate comes only from the short code 786727. Any message from a standard 10-digit phone number, regardless of what the sender’s name says, is a fraud.

This guide tells you exactly what the scam looks like, how it works, and what to do if you receive one of those messages.

What Is the SunPass Scam?

The SunPass scam is a text message fraud that impersonates Florida’s official prepaid toll program. Scammers send fake messages claiming you have an outstanding toll balance and threatening fees or license suspension if you do not pay immediately.

The link in the message leads to a convincing fake website designed to steal your credit card information and personal details. This scam runs on urgency and fear. They want you panicking and clicking before you stop to think.

This is not a small operation. The FBI’s Internet Crime Complaint Center (IC3) issued a nationwide alert about toll-related smishing scams hitting multiple states, including Florida.

Florida is especially targeted because it has more than 700 miles of toll roads, the highest mileage of any state in the country, serving over 22 million residents and approximately 130 million annual visitors.

A Real Example of How This Plays Out

Consider a scenario that thousands of Florida drivers have experienced firsthand. A tourist named Carlos drives from Miami to Orlando for a long weekend. He used the Florida Turnpike on the way up. Three days later, back home, he receives this text:

“Florida Toll Services: Your vehicle has an outstanding balance of $4.35. Failure to pay within 24 hours will result in a $50 late fee and possible suspension of your vehicle registration. Pay now at: sunpass-fl-payments.top”

Carlos genuinely used a toll road. He does not remember exactly how much it cost. The amount feels plausible. The threat of a $50 penalty feels real. So he clicks the link and enters his card details.

He just handed his full payment information to a criminal syndicate operating out of China.

This scenario plays out every single day across Florida. Tourists are particularly vulnerable because they genuinely do not know whether they missed a toll, and they have no baseline for what a real SunPass message looks like.

Who Is Behind These Scams?

Understanding who runs this operation helps explain why it is so hard to stop. These scams do not come from lone hackers. They are run by a highly organised international criminal network.

Security researchers at Palo Alto Networks Unit 42 identified the primary group responsible as the “Smishing Triad”, a syndicate believed to operate primarily out of China. Between January 2024 and mid-2025, this group registered over 194,000 fraudulent domains linked to toll scam operations alone.

Their model works like this:

• They build convincing fake SunPass payment portals complete with official logos, fonts, and colour schemes
• They package these fake sites into ready-to-deploy “phishing kits”
• They sell or share those kits on encrypted platforms like Telegram to a wide network of affiliates
• Thousands of affiliates then blast the scam texts to random Florida phone numbers, regardless of whether the recipient even owns a car

Because of this decentralised structure, shutting down one fake website barely slows them down. A new cluster of fraudulent domains can appear within hours of a takedown. As of March 2026, some motorists report receiving these messages as frequently as three times per week.

How the Scam Evolved in 2026

The scam has grown more sophisticated over time. It started as email fraud around 2019, shifted to text messages by 2024, and has now evolved in two critical ways that make it more dangerous than ever.

The “Reply Y” Trick

Apple and Google added security filters that automatically disable links in texts from unknown numbers. Scammers found a workaround. Messages now include instructions like this:

“Please reply Y, then exit the text message and open it again to activate the link.”

When you reply, the phone’s security system thinks you are voluntarily messaging a known contact. This re-enables the link. Replying also confirms to the scammer that your number is active, immediately marking you as a verified target for more aggressive follow-up attacks.

Never reply to these messages. Not even to say “STOP.”

Agentic AI Is Now Involved

The most significant development in 2026 is the use of agentic artificial intelligence to automate attacks at machine speed. Unlike older systems that needed human operators to write each message, these AI tools can autonomously monitor real-time Florida news and instantly adjust scam messages to match current events.

For example, when Florida debates new speed limit laws or lane toll changes, the AI updates the message language within hours to reference those specific changes. This makes messages sound timely, credible, and far harder to dismiss as generic spam.

The 2026 Florida Context Scammers Are Exploiting

Scammers deliberately reference real, current Florida developments to make their messages feel legitimate. In early 2026, these real events have provided useful cover:

• New traffic enforcement laws took effect, including changes to registration rules and debated speed limit increases to 80 mph. Scammers reference “new 2026 traffic regulations” to confuse drivers into thinking they violated a rule they do not fully understand.
• Active FDOT construction zones across major arteries mean drivers regularly encounter unexpected toll changes, making a “missed toll” message feel entirely plausible.
• The FDOT’s Target Zero safety initiative has generated widespread news coverage. Scammers use the resulting public awareness of road rule changes as social proof for their messages.

If a message references any new Florida law or road project in 2026, that detail alone does not make it legitimate. It makes it more suspicious.

How to Spot a Fake SunPass Text

Knowing the warning signs is your best defence. Fake messages follow predictable patterns once you know what to look for.

Red Flags to Watch For

Fake URL vs. Real URL: What to Look For

Scammers design their URLs to look legitimate on a small mobile screen. Here is exactly how they do it:

The only legitimate domain for managing your SunPass account is sunpass.com with nothing added before or after it.

The Small Amount Trick Explained

Scammers intentionally keep the claimed balance under $10. A $7 fee feels too small to bother questioning. Most people figure paying it is easier than disputing it. That logic is exactly what the scammers count on.

Once you enter your card details on the fake site, the actual theft is far from small. Criminals use captured card details for high-value unauthorised purchases or load them into mobile wallets to make in-person retail transactions that banks find harder to flag as fraud.

What Official SunPass Communication Actually Looks Like

One of the best ways to avoid this scam is knowing precisely how the real SunPass contacts you. Legitimate SunPass communication follows strict rules that never vary.

SunPass will never send a text demanding immediate payment through a link. Legitimate low-balance alerts point you to the app or official website. They never include a one-click payment button. If a message pressures you to pay right now through a link, it is a scam. Full stop.

What Happens If You Click the Link

The fake site is built to collect as much information as possible across multiple pages. Understanding each stage helps explain why acting quickly matters if you have already clicked.

Stage 1: Payment Details

The first page looks nearly identical to the real SunPass portal. It asks for your card number, expiration date, and CVV. The page design, logo, and colour scheme are often copied pixel-for-pixel from the real site.

Stage 2: Identity Harvest

Secondary pages then ask you to “verify your identity.” Victims are prompted to provide:

• Full legal name and home address
• Phone number
• Social Security Number or Driver’s License number

Stage 3: Ongoing Exploitation

The stolen data does not get used just once. It feeds into a structured criminal system:

• Mobile wallet fraud: Your card gets loaded into Apple Pay or Google Pay on criminal-controlled devices for in-person retail purchases
• Credential stuffing: Your email and password get tested across thousands of other platforms including banks, shopping sites, and social media
• Spear phishing: Your name and address get used later to craft highly personalised fake bank or Amazon security alerts
• Identity resale: Your complete profile gets sold on dark web markets to syndicates specialising in tax fraud and fraudulent credit applications

What To Do Right Now If You Got One of These Texts

If you have just received a suspicious SunPass message, follow these steps in order. Do not skip ahead.

1. Do not click the link. Even opening it can trigger a malware download on some devices.
2. Do not reply. Replying with anything, including “NO” or “STOP,” confirms your number is active and invites more targeted attacks.
3. Forward the message to 7726. This universal SPAM reporting shortcode works across all major US carriers and helps block the sender network-wide.
4. Check your real account independently. Type sunpass.com manually into your browser. Do not use any link or phone number from the suspicious message.
5. Report it to two places. File a complaint at reportfraud.ftc.gov and at ic3.gov. Both reports contribute to active federal investigations.
6. Delete the message. Remove it from your inbox so you cannot accidentally interact with it later.

Emergency Steps If You Already Clicked

If You Clicked the Link But Entered Nothing

Your risk is lower but not zero. Some links trigger automatic malware downloads. Take these steps immediately:

• Turn off Wi-Fi and mobile data to stop any potential data transmission
• Run a trusted antivirus scan on your device
• Check your browser’s download history and delete any unrecognised files

If You Entered Payment Information

Call your bank or card issuer immediately. Do not wait. Tell them you entered your card details on a fraudulent website and request:

• Immediate cancellation of the compromised card
• Removal of any new virtual cards recently added to your account
• A formal fraud claim under zero-liability protections

Then report the fraud to the FTC at reportfraud.ftc.gov and file a complaint with the FBI IC3.

If You Entered Personal Identity Information

If you provided a Social Security Number or a Driver’s License number, the response needs to go further:

• Freeze your credit immediately with all three bureaus:
  • Equifax
  • Experian
  • TransUnion
• File an identity theft report at IdentityTheft.gov for a structured recovery plan and documentation to dispute fraudulent activity
• Change passwords on every account that shares credentials with your SunPass login, prioritising your email and any financial accounts

How Florida Authorities Are Fighting Back

The response from state and federal agencies has been significant. It helps to know what is already working and where the gaps remain.

Florida Attorney General Ashley Moody’s Cyber Fraud Enforcement Unit, working alongside the Florida Department of Law Enforcement (FDLE), has successfully identified and shut down hundreds of fraudulent SunPass websites.

The state also launched Scams at a Glance: SunPass Safety, a trilingual consumer guide available in English, Spanish, and Creole that explicitly details official SunPass communication protocols.

At the federal level, the FBI IC3 collects complaint data from across all 50 states to track the Smishing Triad’s patterns as it moves from state to state. County sheriffs across Florida, including those in Escambia, Alachua, Lee, and Monroe counties, have issued localized alerts and serve as first points of contact for victims reporting fraud.

The challenge is that the criminal infrastructure can spin up new fraudulent domains within hours of any takedown. Law enforcement can win individual battles while the broader campaign continues. An informed public remains the most durable defence available.

Long-Term Habits That Keep You Safe

Prevention is always easier than recovery. A few consistent habits make this scam nearly impossible to pull off against you.

Know your real balance at all times. Log into your actual SunPass account and set up balance notifications through the official app or at SunPass.com. When you already know your balance, a fake “you owe money” text is immediately obvious.

Use a dedicated secondary card for toll accounts. Link a low-limit prepaid or secondary credit card to your SunPass account. If that card is ever compromised, the damage stays contained and your primary account remains untouched.

Enable two-factor authentication. SunPass accounts support 2FA. Even if a scammer captures your password through a phishing attack, they cannot log in without the second verification code sent to your phone.

Bookmark the real site now. Add sunpass.com to your browser bookmarks today. Using a saved bookmark eliminates the risk of mistyping or following a fraudulent link the next time you need to check your account.

Frequently Asked Questions

These are the questions Florida drivers ask most often about this scam.

Is the SunPass text I received real?

Check the sender. If it came from anything other than the five-digit short code 786727, it is not from SunPass. If it contains a payment link, it is not from SunPass. Go directly to sunpass.com to check your actual account balance.

What is short code 786727?

It is the only authorised number SunPass uses to send text messages. Any text about your SunPass account that comes from a standard 10-digit phone number is fraudulent, regardless of what the sender’s name displays.

I replied “Y” to one of these messages. What do I do?

Replying confirms your number is active. You should expect follow-up scam attempts. Block the number, forward the original message to 7726, and monitor your inbox for more targeted messages over the coming days.

Can I get my money back if I paid a fake SunPass site?

In many cases, yes. Contact your bank immediately and file a fraud claim. Most major banks and credit card issuers have zero-liability fraud policies. The faster you report it, the better your chances of a full refund.

Why does the fake website look exactly like the real SunPass site?

Scammers purchase professional phishing kits that include pixel-for-pixel copies of the official SunPass portal, including logos, fonts, and colour schemes. These kits are built specifically to be indistinguishable from the real site on a mobile screen.

Does SunPass ever send texts asking for payment?

No. SunPass sends informational low-balance alerts by text, but those messages direct you to the app or website and never include a direct payment link. Unpaid toll notices are always sent by U.S. Mail.

I am a tourist visiting Florida. How do I know if I actually owe tolls?

Go directly to sunpass.com and use the “Pay by Plate” option to check whether your vehicle’s licence plate has any outstanding balances. Do not use any link from an unsolicited text message.

Stay One Step Ahead, Florida

The SunPass scam in 2026 is a sophisticated, machine-speed operation backed by international criminal networks and artificial intelligence. But its power depends entirely on you not knowing how it works.

Now you do. The single most important rule: SunPass will never ask you to pay via a text link. If a message does that, it is a scam. Every time.

Share this with your family, your coworkers, and especially any tourists visiting Florida who have never encountered SunPass before. The more people who recognise these messages for what they are, the less effective this scam becomes.

Pavithra Vinoth

Pavithra Vinoth is the founder of nytollsinfo.com, where she simplifies U.S. toll systems through expert insights and custom-built calculators. Her research-driven tools help drivers avoid costly mistakes and make smarter car decisions.