Why toll texts work on so many people
The amount is tiny, usually a few dollars, which makes paying feel cheaper than checking. The threatened consequence is disproportionate and administrative: late fees, points, or a suspended vehicle registration. Most people resolve small bureaucratic annoyances quickly rather than carefully.
The messages are sent in bulk, so a meaningful proportion reach people who genuinely used a toll road recently, and coincidence does the persuading. Criminals also spoof the correct agency for the state or province implied by the phone number, which raises the hit rate further.
- A trivial amount that feels too small to be worth a scam
- A disproportionate threat: fees, points, registration suspension
- A named, real toll system: E-ZPass, SunPass, FasTrak, TxTag, 407 ETR
- A short deadline, often 'today' or within 12 hours
- A link on a domain that is not the agency's official site
What the criminals actually collect
The payment page harvests the full card number, expiry, security code, billing address and often a phone number and date of birth. The few dollars charged, if anything is charged at all, is irrelevant next to a complete card record plus verified personal data.
Many of these pages then add a one-time code step, asking you to enter the code your bank just texted you. That step is how a card gets added to a digital wallet on the criminal's phone, which is why the resulting fraud often appears as contactless spending rather than online purchases.
How to check a toll balance safely
Never use the link. Open the toll agency's own app or type its official address yourself, log in and look at the balance. Agencies bill through the account you registered, or by post to the registered vehicle keeper, and they do not chase small tolls by text with a payment link.
If you are unsure which agency operates a road you used, search for it independently rather than trusting the one named in the message. Official US toll authority sites are typically on .gov or a long-established agency domain, and Canadian operators such as 407 ETR bill registered account holders directly.
- Check inside the agency's own app or typed-in website
- Compare the sender domain with the official one, character by character
- Remember agencies bill the registered account or by post
- Be suspicious of any toll message on a road you never used
- Forward scam texts to 7726 (SPAM) in the US, UK and Canada
If you already entered your card details
Call your bank or card issuer immediately and ask them to block and reissue the card. Do this even if no charge has appeared: stolen details are often used days or weeks later, and once the card is cancelled the record is worthless.
If you entered a one-time code as well, tell the bank explicitly, because that suggests a wallet provisioning attempt rather than simple card theft and needs a different response. Then watch for the follow-up call from a fake bank fraud team quoting the transaction you just made, which is the standard second act.
- Block and reissue the card the same day
- Tell the bank if you entered a one-time code
- Check statements for small test charges as well as large ones
- Expect a fake 'bank fraud team' call and hang up on it
- Report to the FTC at ReportFraud.ftc.gov, IC3, or the Canadian Anti-Fraud Centre
The wider pattern of government impersonation
Toll messages are one strand of a much larger category. The FTC reported around $920 million lost to government impersonators in 2025, spanning fake tax demands, benefit and immigration messages, court and jury-duty threats, and vehicle or licence notices. Bank impersonation was costlier still, at close to $1 billion across business impersonators.
The defence generalises neatly: no government agency demands payment by text, gift card, crypto or wire transfer, and none threatens immediate arrest or suspension over a message. Verify through an official channel you find yourself, every time. Our tax refund scams and text message scams guides cover the neighbouring versions.