Unpaid Toll Scam: The Complete Guide to Protecting Yourself in 2026!

You just got a text saying you owe $12.51 in unpaid tolls. It looks official. It feels urgent. And it is almost certainly a scam.

Toll scam texts have exploded across all 50 states in 2026, costing Americans hundreds of millions of dollars. This guide explains exactly how these scams work, how to spot them, and what to do if you already clicked a link.

What Is the Unpaid Toll Scam?

The unpaid toll scam is a type of fraud called smishing, which stands for SMS phishing. Scammers send fake text messages that pretend to be from toll agencies like E-ZPass, SunPass, FasTrak, or TxTag.

The message claims you owe a small fee on an unpaid toll. It includes a link. That link takes you to a fake payment page designed to steal your credit card information and personal data.

The real goal is never the $12 fee. The scammers want your card number, your name, and your personal identifiers.

Who Is Behind These Scams?

These are not random opportunists sending a few texts. A sophisticated, organized crime group known as the “Smishing Triad” is behind most of these attacks.

This threat actor group has built what researchers call a “Phishing as a Service” (PhaaS) ecosystem. They provide everything a scammer needs, including ready-made fake websites, target phone number lists, and messaging tools.

The scale is staggering. Between January 2024 and mid 2025 alone, researchers identified the registration of 194,345 fraudulent domains linked to this group, according to The Hacker News.

In early 2026, the International Bridge, Tunnel and Turnpike Association (IBTTA) documented 437 new toll scam sites appearing in a single week, targeting 19 states at once.

How the Scam Works Step by Step

Understanding the scam mechanics is the fastest way to protect yourself. Here is exactly what happens from start to finish.

Step 1: The Hook Text Arrives

You receive a text from an unknown number. It claims you owe a small, specific amount, something like $12.51 or $11.75. The amount is deliberately small and precise to feel like a genuine billing oversight.

The message uses threatening language to create urgency. Common phrases include:

• “Final Notice”
• “Notice of Toll Evasion”
• “Urgent: Vehicle Registration Suspension Pending”
• “Pay now to avoid additional fees”

Step 2: You Click the Link

The link in the text looks close to a real toll agency URL, but it is not. For example, you might see something like ezpassnj.gov-mhmt.xin this instead of the real site.

The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) found that 82% of these fake domains use unusual extensions like .xin, .vip, .top, .win, .cc, and .live.

The fake site mirrors the real toll agency’s branding perfectly. It shows the right logo, the right colors, and a convincing payment form.

Step 3: Your Data Is Stolen

You enter your card details. The site may even show a “payment confirmed” screen to avoid suspicion. Within hours, your card information is sold on dark web marketplaces or used directly for fraudulent purchases.

The Tricks Scammers Use to Bypass Your Phone’s Security

Mobile operating systems have gotten smarter. So have the scammers. Here are two techniques they use in 2026 to get around your phone’s built-in protections.

The iMessage “Reply Y” Trick

Apple’s iMessage automatically disables links from unknown senders. To get around this, scammers include a specific instruction in their message.

“Please reply Y, then exit the text message and open it again to activate the link.”

When you reply, iOS treats the conversation as active and re enables the link. You have just manually switched off your own phone’s protection. Malwarebytes documented this technique as one of the most effective social engineering moves in recent memory. Never reply to a suspicious text, even to say “stop.”

Domain Obfuscation

The Smishing Triad constantly rotates through thousands of new domains to stay ahead of blocklists. Each domain lives for just a few days before being replaced. This “rapid churn” strategy means most spam filters cannot keep up with the volume of new URLs being generated every day.

Which States and Toll Agencies Are Targeted?

Scammers customize their messages to match the toll system in your state. Here is a quick overview of the most affected regions.

Even if you live in a state with no toll roads, you can still receive these texts. Hawaii has no toll roads at all, yet the Hawaii Department of Transportation issued a public warning in 2026 after residents received fake “unpaid toll” messages.

Scammers use a “spray and pray” method, sending millions of messages and hoping someone bites.

How to Spot a Fake Toll Text Immediately

Before anything else, run through this quick checklist when you receive a suspicious text.

Red flags to look for:

• The message comes from a random 10-digit phone number or an international code like +63
• The URL does not match the official toll agency website exactly
• The domain ends in .xin, .vip, .top, .live, .cc, or .win
• The message threatens license suspension or legal action
• The message asks you to reply with “Y” to activate a link
• Payment is requested through Zelle, Venmo, or a random link
• There is no account number or reference ID in the message

One rule to remember: Real toll agencies in the United States do not demand payment through links in text messages. Full stop.

The Financial Damage: By the Numbers

The scale of this problem is hard to overstate. Here are the facts from recent data.

• $470 million lost by American consumers to scam texts in 2024 alone
• $54 million per month in global losses from smishing in 2026
• 194,345 fraudulent domains registered by the Smishing Triad across two years
• 437 new toll scam sites created in a single week in early 2026

According to Keepnet Labs’ 2026 smishing statistics report, older adults aged 55 and above are frequently targeted because they are perceived as having higher credit limits. Researchers also found that demographic data purchased from dark web brokers is being used to refine scammer target lists.

What Your Phone Can Do to Protect You in 2026

The good news is that both Apple and Google have made major improvements to help you fight back. You just need to make sure the right settings are turned on.

Apple iOS 26

iOS 26 completely restructured the Messages inbox. It now sorts incoming texts into four categories automatically:

1. Messages reserved for known contacts
2. Unknown Senders for unsolicited texts not yet flagged
3. Spam for messages identified as suspicious by on-device AI
4. Recently Deleted as a safety net

Any message sent to the Spam folder has all links automatically disabled. The system also blocks replies to those messages by default, which neutralizes the “Reply Y” trick entirely.

Android with Gemini Scam Detection

Google has built Gemini Nano AI directly into the Messages app on devices like the Pixel 10 and Galaxy S26. This tool analyzes the language patterns inside a message in real time and displays a yellow warning banner when it detects fraud signals, even if the URL has never been seen before.

Carrier Level Protection

All three major US carriers now offer active spam blocking:

• T-Mobile: Scam Shield (free and premium tiers available)
• AT&T: ActiveArmor Mobile Security app
• Verizon: Call Filter with spam detection

Check your carrier’s app store or account settings to activate these features. Many are free and off by default.

What to Do Right Now If You Got a Suspicious Text

The moment you receive a suspicious toll text, follow these steps.

1. Do not click the link. Not even to “check what it is.”
2. Do not reply. Replying confirms your number is active.
3. Forward the text to 7726. This reports it to your carrier and helps block it for everyone.
4. Report it to the FTC at ReportFraud.ftc.gov.
5. Report it to the FBI at IC3.gov.
6. Check your actual toll balance by going directly to your toll agency’s official website. Type the address yourself. Do not use any link from the suspicious text.

What to Do If You Already Clicked the Link

Do not panic. Act fast and follow this recovery framework in order.

Immediate Steps

Credit Bureau Freeze Contact Numbers

Freezing your credit costs nothing and blocks scammers from opening new accounts in your name, even if they have your Social Security number.

• Equifax: 800-685-1111
• Experian: 888-397-3742
• TransUnion: 888-909-8872

If Your Identity Were Fully Compromised

If the scammers obtained your Social Security number or driver’s license information, use the FTC’s official recovery tool at IdentityTheft.gov. It generates an official Identity Theft Report and walks you through a personalized recovery plan.

Follow these five steps from the FTC’s 2026 guidelines:

1. Call companies where fraud occurred and close or freeze those accounts
2. Change all passwords and turn on multi-factor authentication everywhere
3. File the Identity Theft Report with the FTC at IdentityTheft.gov
4. File a police report using your FTC report as supporting evidence
5. Contact the IRS to get an Identity Protection PIN, which prevents anyone from filing taxes using your Social Security number

A Warning About Recovery Scammers

If you have already been scammed, watch out for a second wave. A growing number of “Recovery Scammers” contact past victims, claiming they can retrieve stolen funds for an upfront fee.

They find their targets through leaked data from the original phishing sites or through social media. Only your bank or a legal authority can reverse a transaction. Anyone claiming to have special hacking skills to recover your money is running a second scam.

Proactive Habits That Keep You Protected

Prevention takes about 20 minutes. These five habits will protect you going forward.

• Download your toll agency’s official app so you always have a trusted payment portal at hand
• Register your vehicle with your state’s toll authority to receive communications through verified channels
• Use a virtual card number for online toll payments so your real card stays private
• Enable transaction alerts on all your cards to catch unauthorized charges within minutes
• Check your credit report for free at AnnualCreditReport.com, the only federally authorized free credit report site in the US

Stay One Step Ahead

The unpaid toll scam is professionally built, globally operated, and constantly evolving. The Smishing Triad is not a handful of teenagers in a basement. It is an industrialized fraud operation with specialists, rotating infrastructure, and AI-assisted targeting.

But here is the thing. The entire scam collapses the moment you stop and verify. Go to your toll agency’s app. Check your actual balance. If there is no balance, there is no problem.

Pass this guide on to someone who needs it. A friend, a parent, a coworker who clicks everything. The more people who know how this works, the harder it becomes for the scammers to win.

Pavithra Vinoth

Pavithra Vinoth is the founder of nytollsinfo.com, where she simplifies U.S. toll systems through expert insights and custom-built calculators. Her research-driven tools help drivers avoid costly mistakes and make smarter car decisions.