Received a Text About Unpaid Tolls? The FTC Says It’s Probably a Phishing Scam

If you received a text message about unpaid tolls, there’s a good chance it’s a scam.

The Federal Trade Commission (FTC) warns that fraudsters use a phishing scam to get people to share financial information, like their bank details, to pay a fake unpaid toll. While it’s understandably stressful to be told you owe money, it’s important not to panic. Instead, look for signs of a scam and proceed with caution.

How the unpaid-toll text scam works

The unpaid toll text scam starts with a supposed toll agency claiming that the target owes a small balance. A payment link is provided, potentially alongside threats concerning late fees and other consequences for not acting immediately.

It’s a form of smishing, which is basically phishing conducted through text messages. A scammer acts as a legitimate company or agency to steal money from victims. They can even set up their fraudulent companies to closely resemble real ones. These fraudulent websites will eventually ask for sensitive details, such as your credit card number and bank information.

If a scammer obtains this information, they can conduct fraudulent purchases that go well beyond the fake toll bill.

How to tell whether a toll notice is legitimate

There are red flags you can check for. A sudden text that demands immediate payment is the hallmark of a smishing attempt. A slightly misspelled domain name or email address is another red flag, especially if it comes with a link or a QR code.

Good grammar isn’t enough to make a text legitimate. In fact, it often makes sense to ignore the text entirely. Instead, type the toll agency’s name in a search engine and go to its website. Then, call the number listed on the website and verify if the toll bill you saw in the text is legitimate. The Federal Communications Commission has a guide on how to spot toll road payment scam texts, including a sample text.

This smishing campaign isn’t just limited to fake toll bills. Scammers also use this strategy to impersonate the Department of Motor Vehicles (DMV) and courts with threats ranging from license suspensions and prosecution to traffic hearings and high fees.

What to do after receiving or clicking the text

If you didn’t click, you can simply use the “report junk” feature before deleting the text. Most smartphones let you do this by tapping a button without any additional work. You can also forward the message to 7726 (or SPAM).

People who clicked the link should close the page and not do anything else on the site. Change any passwords entered on the site, especially if you use the same password for other logins. In the event you provided financial information, start by locking or replacing the affected card and disputing unauthorized charges. You should also contact the card issuer or bank immediately.

Consumers who shared sensitive personal information with a scammer should consider a credit freeze to ensure the bad actor cannot take out loans and credit lines under your name. It’s a good idea to monitor your accounts and credit reports to ensure fraudulent activity did not take place. You can visit IdentityTheft.gov for a personalized recovery plan.